{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T19:10:46.198Z", "tag": { "id": "ransomware", "label": "Ransomware", "isStack": false, "url": "https://pwn.watch/t/ransomware", "feed": "https://pwn.watch/t/ransomware/feed.xml" }, "counts": { "incidents": 117, "live": 0, "notFullyPatched": 0, "patched": 116 }, "incidents": [ { "slug": "broadcom-vmware-vcenter-cve-2026-59310", "title": "Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability", "url": "https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310", "json": "https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Broadcom VMware vCenter", "tags": [ "vmware", "vcenter", "broadcom", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-59310" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-18", "closedAt": "2026-08-18", "updatedAt": "2026-08-18", "summary": "Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. Added to CISA KEV on 2026-08-18.", "xPost": null }, { "slug": "jetbrains-teamcity-cve-2026-63077", "title": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077", "json": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "JetBrains TeamCity", "tags": [ "devtools", "jetbrains", "teamcity", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-63077" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-05", "closedAt": "2026-08-05", "updatedAt": "2026-08-05", "summary": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Added to CISA KEV on 2026-08-05.", "xPost": null }, { "slug": "cisco-secure-firewall-management-center-fmc-cve-2026-20316", "title": "Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability", "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316", "json": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Cisco Secure Firewall Management Center (FMC)", "tags": [ "cisco", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-20316" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-29", "closedAt": "2026-07-29", "updatedAt": "2026-07-29", "summary": "Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. Added to CISA KEV on 2026-07-29.", "xPost": null }, { "slug": "sonicwall-sma1000-appliances-cve-2026-15409", "title": "SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability", "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-15409", "json": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-15409.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "SonicWall SMA1000 Appliances", "tags": [ "sonicwall", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-15409", "CVE-2026-15410" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-14", "closedAt": "2026-07-14", "updatedAt": "2026-07-14", "summary": "SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. CISA added CVE-2026-15409, CVE-2026-15410 to the Known Exploited Vulnerabilities catalog on 2026-07-14 based on evidence of active exploitation.", "xPost": null }, { "slug": "microsoft-sharepoint-server-cve-2026-45659", "title": "Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659", "json": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint Server", "tags": [ "microsoft", "sharepoint", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-45659" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-01", "closedAt": "2026-07-01", "updatedAt": "2026-07-01", "summary": "Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. Added to CISA KEV on 2026-07-01.", "xPost": null }, { "slug": "ptc-windchill-and-flexplm-cve-2026-12569", "title": "PTC Windchill and FlexPLM: PTC Windchill and FlexPLM Improper Input Validation Vulnerability", "url": "https://pwn.watch/i/ptc-windchill-and-flexplm-cve-2026-12569", "json": "https://pwn.watch/i/ptc-windchill-and-flexplm-cve-2026-12569.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "PTC Windchill and FlexPLM", "tags": [ "ptc", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-12569" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-06-25", "closedAt": "2026-06-25", "updatedAt": "2026-06-25", "summary": "PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network. Added to CISA KEV on 2026-06-25.", "xPost": null }, { "slug": "oracle-peoplesoft-enterprise-peopletools-cve-2026-35273", "title": "Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273", "json": "https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Oracle PeopleSoft Enterprise PeopleTools", "tags": [ "oracle", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-35273" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-06-12", "closedAt": "2026-06-12", "updatedAt": "2026-06-12", "summary": "Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Added to CISA KEV on 2026-06-12.", "xPost": null }, { "slug": "check-point-security-gateway-cve-2026-50751", "title": "Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerability", "url": "https://pwn.watch/i/check-point-security-gateway-cve-2026-50751", "json": "https://pwn.watch/i/check-point-security-gateway-cve-2026-50751.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Check Point Security Gateway", "tags": [ "check-point", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-50751" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-06-08", "closedAt": "2026-06-08", "updatedAt": "2026-06-08", "summary": "Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. Added to CISA KEV on 2026-06-08.", "xPost": null }, { "slug": "palo-alto-networks-pan-os-cve-2026-0257", "title": "Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257", "json": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-0257" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-29", "closedAt": "2026-05-29", "updatedAt": "2026-05-29", "summary": "Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. Added to CISA KEV on 2026-05-29.", "xPost": null }, { "slug": "nx-nx-console-cve-2026-48027", "title": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability", "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027", "json": "https://pwn.watch/i/nx-nx-console-cve-2026-48027.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Nx Nx Console", "tags": [ "node", "devtools", "nx", "supply-chain", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-48027" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-27", "closedAt": "2026-05-27", "updatedAt": "2026-05-27", "summary": "Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory. Added to CISA KEV on 2026-05-27.", "xPost": null }, { "slug": "tanstack-tanstack-cve-2026-45321", "title": "TanStack TanStack: TanStack Unspecified Vulnerability", "url": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321", "json": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "TanStack TanStack", "tags": [ "node", "npm", "tanstack", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-45321" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-27", "closedAt": "2026-05-27", "updatedAt": "2026-05-27", "summary": "TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. Added to CISA KEV on 2026-05-27.", "xPost": null }, { "slug": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940", "title": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940", "json": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "WebPros cPanel & WHM and WP2 (WordPress Squared)", "tags": [ "wordpress", "hosting", "cpanel", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-41940" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-30", "closedAt": "2026-04-30", "updatedAt": "2026-04-30", "summary": "WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.", "xPost": null }, { "slug": "microsoft-defender-cve-2026-33825", "title": "Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability", "url": "https://pwn.watch/i/microsoft-defender-cve-2026-33825", "json": "https://pwn.watch/i/microsoft-defender-cve-2026-33825.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Defender", "tags": [ "microsoft", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-33825" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-22", "closedAt": "2026-04-22", "updatedAt": "2026-04-22", "summary": "Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. Added to CISA KEV on 2026-04-22.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-60710", "title": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-60710", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-60710.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-60710", "CVE-2023-36424" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-13", "closedAt": "2026-04-13", "updatedAt": "2026-04-13", "summary": "Microsoft Windows contains a link following vulnerability that allows for privilege escalation CISA added CVE-2025-60710, CVE-2023-36424 to the Known Exploited Vulnerabilities catalog on 2026-04-13 based on evidence of active exploitation.", "xPost": null }, { "slug": "cisco-secure-firewall-management-center-fmc-cve-2026-20131", "title": "Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management", "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131", "json": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Cisco Secure Firewall Management Center (FMC)", "tags": [ "cisco", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-20131" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-19", "closedAt": "2026-03-19", "updatedAt": "2026-03-19", "summary": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. Added to CISA KEV on 2026-03-19.", "xPost": null }, { "slug": "solarwinds-web-help-desk-cve-2025-26399", "title": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-26399", "json": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-26399.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "SolarWinds Web Help Desk", "tags": [ "solarwinds", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-26399" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-09", "closedAt": "2026-03-09", "updatedAt": "2026-03-09", "summary": "SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine. Added to CISA KEV on 2026-03-09.", "xPost": null }, { "slug": "beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731", "title": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln", "url": "https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731", "json": "https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)", "tags": [ "beyondtrust", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-1731" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-13", "closedAt": "2026-02-13", "updatedAt": "2026-02-13", "summary": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption. Added to CISA KEV on 2026-02-13.", "xPost": null }, { "slug": "smartertools-smartermail-cve-2026-24423", "title": "SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/smartertools-smartermail-cve-2026-24423", "json": "https://pwn.watch/i/smartertools-smartermail-cve-2026-24423.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "SmarterTools SmarterMail", "tags": [ "smartermail", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-24423" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-05", "closedAt": "2026-02-05", "updatedAt": "2026-02-05", "summary": "SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. Added to CISA KEV on 2026-02-05.", "xPost": null }, { "slug": "smartertools-smartermail-cve-2025-52691", "title": "SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability", "url": "https://pwn.watch/i/smartertools-smartermail-cve-2025-52691", "json": "https://pwn.watch/i/smartertools-smartermail-cve-2025-52691.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "SmarterTools SmarterMail", "tags": [ "smartermail", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-52691", "CVE-2026-23760" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-01-26", "closedAt": "2026-01-26", "updatedAt": "2026-01-26", "summary": "SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. CISA added CVE-2025-52691, CVE-2026-23760 to the Known Exploited Vulnerabilities catalog on 2026-01-26 based on evidence of active exploitation.", "xPost": null }, { "slug": "watchguard-firebox-cve-2025-14733", "title": "WatchGuard Firebox: Firebox Out of Bounds Write Vulnerability", "url": "https://pwn.watch/i/watchguard-firebox-cve-2025-14733", "json": "https://pwn.watch/i/watchguard-firebox-cve-2025-14733.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "WatchGuard Firebox", "tags": [ "watchguard", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-14733" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-12-19", "closedAt": "2025-12-19", "updatedAt": "2025-12-19", "summary": "WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. Added to CISA KEV on 2025-12-19.", "xPost": null }, { "slug": "react2shell-react-server-components-cve-2025-55182", "title": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182", "json": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "React Server Components (react-server-dom-*), Next.js", "tags": [ "node", "react2shell", "react", "nextjs", "vercel", "rce", "zero-day", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-55182" ], "affectedVersions": [ "React 19.0.0, 19.1.0-19.1.1, 19.2.0 (react-server-dom-webpack / -parcel / -turbopack)", "Next.js App Router releases using affected React (see advisory)" ], "fixedVersions": [ "React 19.0.1", "React 19.1.2", "React 19.2.1", "Next.js: patched release lines per the React/Next.js advisory" ], "startedAt": "2025-12-03", "closedAt": "2025-12-12", "updatedAt": "2025-12-12", "summary": "A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.", "xPost": null }, { "slug": "oracle-e-business-suite-cve-2025-61884", "title": "Oracle E-Business Suite: E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability", "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2025-61884", "json": "https://pwn.watch/i/oracle-e-business-suite-cve-2025-61884.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle E-Business Suite", "tags": [ "oracle", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-61884" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-20", "closedAt": "2025-10-20", "updatedAt": "2025-10-20", "summary": "Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication. Added to CISA KEV on 2025-10-20.", "xPost": null }, { "slug": "microsoft-windows-cve-2011-3402", "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402", "json": "https://pwn.watch/i/microsoft-windows-cve-2011-3402.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2011-3402", "CVE-2013-3918", "CVE-2021-43226" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-06", "closedAt": "2025-10-06", "updatedAt": "2025-10-06", "summary": "CVE-2011-3402: Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page. CVE-2013-3918: Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2021-43226: Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms. Added to CISA KEV on 2025-10-06.", "xPost": null }, { "slug": "fortra-goanywhere-mft-cve-2025-10035", "title": "Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035", "json": "https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortra GoAnywhere MFT", "tags": [ "goanywhere", "fortra", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-10035" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-09-29", "closedAt": "2025-09-29", "updatedAt": "2025-09-29", "summary": "Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Added to CISA KEV on 2025-09-29.", "xPost": null }, { "slug": "oracle-ebs-cl0p-extortion-cve-2025-61882", "title": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882", "json": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle E-Business Suite", "tags": [ "oracle", "cl0p", "zero-day", "rce", "data-breach", "extortion", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-61882" ], "affectedVersions": [ "Oracle E-Business Suite 12.2.3 to 12.2.14" ], "fixedVersions": [ "Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)" ], "startedAt": "2025-09-29", "closedAt": "2025-10-20", "updatedAt": "2025-10-20", "summary": "Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.", "xPost": null }, { "slug": "asahi-ransomware-qilin-september-2025", "title": "Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it)", "url": "https://pwn.watch/i/asahi-ransomware-qilin-september-2025", "json": "https://pwn.watch/i/asahi-ransomware-qilin-september-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Asahi Group Holdings (Japan operations)", "tags": [ "asahi", "qilin", "manufacturing", "ransomware" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-09-29", "closedAt": "2025-10-15", "updatedAt": "2025-10-15", "summary": "A ransomware attack on September 29, 2025 stopped Asahi Group's order processing, shipments and call centres in Japan and briefly halted its six Japanese beer plants. Asahi confirmed ransomware and possible data theft; Qilin claimed the attack and leaked files it said were stolen.", "xPost": null }, { "slug": "collins-aerospace-muse-ransomware-airports-2025", "title": "Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin", "url": "https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025", "json": "https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Collins Aerospace MUSE (airport check-in and boarding)", "tags": [ "collins-aerospace", "rtx", "aviation", "ransomware" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-09-19", "closedAt": "2025-09-24", "updatedAt": "2025-09-24", "summary": "Ransomware hit RTX's Collins Aerospace MUSE passenger-processing software on September 19, 2025, breaking electronic check-in, bag drop and boarding at several European airports. Airports fell back to manual check-in and handwritten boarding passes; Brussels was still disrupted days later. ENISA confirmed it was ransomware.", "xPost": null }, { "slug": "jaguar-land-rover-cyberattack-production-shutdown-2025", "title": "Jaguar Land Rover cyberattack stops car production for five weeks", "url": "https://pwn.watch/i/jaguar-land-rover-cyberattack-production-shutdown-2025", "json": "https://pwn.watch/i/jaguar-land-rover-cyberattack-production-shutdown-2025.json", "status": "closed", "severity": "critical", "patchStatus": "no-fix-needed", "product": "Jaguar Land Rover (manufacturing IT)", "tags": [ "jaguar-land-rover", "manufacturing", "ransomware" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-08-31", "closedAt": "2025-11-14", "updatedAt": "2025-11-14", "summary": "A cyberattack that began on August 31, 2025 forced JLR to shut down IT systems and halt production worldwide from September 1. A phased restart began October 8; UK production was back to normal by November 14. The UK government guaranteed a £1.5B loan to keep JLR's suppliers afloat.", "xPost": null }, { "slug": "rarlab-winrar-cve-2025-8088", "title": "RARLAB WinRAR: WinRAR Path Traversal Vulnerability", "url": "https://pwn.watch/i/rarlab-winrar-cve-2025-8088", "json": "https://pwn.watch/i/rarlab-winrar-cve-2025-8088.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "RARLAB WinRAR", "tags": [ "rarlab", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-8088" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-12", "closedAt": "2025-08-12", "updatedAt": "2025-08-12", "summary": "RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files. Added to CISA KEV on 2025-08-12.", "xPost": null }, { "slug": "toolshell-sharepoint-cve-2025-53770", "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770", "json": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft SharePoint Server (on-premises)", "tags": [ "toolshell", "microsoft", "sharepoint", "zero-day", "rce", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-49704", "CVE-2025-49706", "CVE-2025-53770" ], "affectedVersions": [ "On-premises SharePoint Server (see Microsoft customer guidance for the exact builds)" ], "fixedVersions": [ "See Microsoft customer guidance for CVE-2025-53770" ], "startedAt": "2025-07-18", "closedAt": "2025-07-22", "updatedAt": "2025-07-22", "summary": "Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.", "xPost": null }, { "slug": "ingram-micro-safepay-ransomware-july-2025", "title": "Ingram Micro SafePay ransomware takes down ordering systems for a week", "url": "https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025", "json": "https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Ingram Micro (Xvantage, Impulse, ordering systems)", "tags": [ "ingram-micro", "safepay", "ransomware" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-07-03", "closedAt": "2025-07-10", "updatedAt": "2025-07-10", "summary": "SafePay ransomware hit IT distributor Ingram Micro around July 3, 2025, taking down its website, ordering systems, the Xvantage platform and Impulse licensing. Ingram Micro took systems offline and restored order processing globally by July 9-10.", "xPost": null }, { "slug": "fortinet-fortios-cve-2019-6693", "title": "Fortinet FortiOS: FortiOS Use of Hard-Coded Credentials Vulnerability", "url": "https://pwn.watch/i/fortinet-fortios-cve-2019-6693", "json": "https://pwn.watch/i/fortinet-fortios-cve-2019-6693.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiOS", "tags": [ "fortinet", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2019-6693" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-25", "closedAt": "2025-06-25", "updatedAt": "2025-06-25", "summary": "Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. Added to CISA KEV on 2025-06-25.", "xPost": null }, { "slug": "citrixbleed-2-netscaler-cve-2025-5777", "title": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777", "json": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Citrix NetScaler ADC and Gateway", "tags": [ "citrixbleed", "citrix", "netscaler", "zero-day", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-5777" ], "affectedVersions": [ "See Citrix bulletin" ], "fixedVersions": [ "14.1-43.56", "13.1-58.32", "13.1-FIPS/NDcPP 13.1-37.235" ], "startedAt": "2025-06-17", "closedAt": "2025-07-10", "updatedAt": "2025-07-10", "summary": "An out-of-bounds read in NetScaler ADC and Gateway leaked memory, including session tokens, to unauthenticated attackers. GreyNoise saw exploitation from June 23, before public PoCs on July 4. After patching, admins had to kill all active ICA, PCoIP, RDP, AAA and LB sessions.", "xPost": null }, { "slug": "sap-netweaver-cve-2025-42999", "title": "SAP NetWeaver: NetWeaver Deserialization Vulnerability", "url": "https://pwn.watch/i/sap-netweaver-cve-2025-42999", "json": "https://pwn.watch/i/sap-netweaver-cve-2025-42999.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SAP NetWeaver", "tags": [ "sap", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-42999" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-15", "closedAt": "2025-05-15", "updatedAt": "2025-05-15", "summary": "SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content. Added to CISA KEV on 2025-05-15.", "xPost": null }, { "slug": "langflow-cve-2025-3248", "title": "Langflow: Missing Authentication Vulnerability", "url": "https://pwn.watch/i/langflow-cve-2025-3248", "json": "https://pwn.watch/i/langflow-cve-2025-3248.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Langflow", "tags": [ "ai", "python", "langflow", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-3248" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-05", "closedAt": "2025-05-05", "updatedAt": "2025-05-05", "summary": "Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. Added to CISA KEV on 2025-05-05.", "xPost": null }, { "slug": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "title": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324", "json": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SAP NetWeaver Visual Composer", "tags": [ "sap", "netweaver", "zero-day", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-31324" ], "affectedVersions": [ "SAP NetWeaver Visual Composer (VCFRAMEWORK); see SAP Security Note" ], "fixedVersions": [ "See SAP Security Note for CVE-2025-31324" ], "startedAt": "2025-04-24", "closedAt": "2025-04-29", "updatedAt": "2025-05-15", "summary": "A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025.", "xPost": null }, { "slug": "marks-and-spencer-ransomware-scattered-spider-april-2025", "title": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days", "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025", "json": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025.json", "status": "closed", "severity": "critical", "patchStatus": "no-fix-needed", "product": "Marks & Spencer (retail IT, VMware ESXi)", "tags": [ "marks-and-spencer", "scattered-spider", "dragonforce", "vmware", "ransomware" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-04-22", "closedAt": "2025-06-10", "updatedAt": "2025-06-10", "summary": "Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-29824", "title": "Microsoft Windows: Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-29824", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-29824.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-29824" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-08", "closedAt": "2025-04-08", "updatedAt": "2025-04-08", "summary": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA KEV on 2025-04-08.", "xPost": null }, { "slug": "crushftp-cve-2025-31161", "title": "CrushFTP: Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/crushftp-cve-2025-31161", "json": "https://pwn.watch/i/crushftp-cve-2025-31161.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CrushFTP", "tags": [ "crushftp", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-31161" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-07", "closedAt": "2025-04-07", "updatedAt": "2025-04-07", "summary": "CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. Added to CISA KEV on 2025-04-07.", "xPost": null }, { "slug": "ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457", "title": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability", "url": "https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457", "json": "https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways", "tags": [ "ivanti", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-22457" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-04", "closedAt": "2025-04-04", "updatedAt": "2025-04-04", "summary": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. Added to CISA KEV on 2025-04-04.", "xPost": null }, { "slug": "fortinet-fortios-and-fortiproxy-cve-2025-24472", "title": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472", "json": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiOS and FortiProxy", "tags": [ "fortinet", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-24472" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-18", "closedAt": "2025-03-18", "updatedAt": "2025-03-18", "summary": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests. Added to CISA KEV on 2025-03-18.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-24983", "title": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-24983.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-24983", "CVE-2025-24984", "CVE-2025-24985", "CVE-2025-24991", "CVE-2025-24993", "CVE-2025-26633" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-11", "closedAt": "2025-03-11", "updatedAt": "2025-03-11", "summary": "CVE-2025-24983: Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2025-24984: Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory. CVE-2025-24985: Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally. CVE-2025-24991: Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally. CVE-2025-24993: Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally. CVE-2025-26633: Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally. Added to CISA KEV on 2025-03-11.", "xPost": null }, { "slug": "vmware-esxi-cve-2025-22225", "title": "VMware ESXi: ESXi Arbitrary Write Vulnerability", "url": "https://pwn.watch/i/vmware-esxi-cve-2025-22225", "json": "https://pwn.watch/i/vmware-esxi-cve-2025-22225.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "VMware ESXi", "tags": [ "vmware", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-22225" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-04", "closedAt": "2025-03-04", "updatedAt": "2025-03-04", "summary": "VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox. Added to CISA KEV on 2025-03-04.", "xPost": null }, { "slug": "microsoft-windows-cve-2018-8639", "title": "Microsoft Windows: Windows Win32k Improper Resource Shutdown or Release Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2018-8639", "json": "https://pwn.watch/i/microsoft-windows-cve-2018-8639.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2018-8639" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-03", "closedAt": "2025-03-03", "updatedAt": "2025-03-03", "summary": "Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. Added to CISA KEV on 2025-03-03.", "xPost": null }, { "slug": "sonicwall-sonicos-cve-2024-53704", "title": "SonicWall SonicOS: SonicOS SSLVPN Improper Authentication Vulnerability", "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704", "json": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SonicWall SonicOS", "tags": [ "sonicwall", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2024-53704" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-18", "closedAt": "2025-02-18", "updatedAt": "2025-02-18", "summary": "SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication. Added to CISA KEV on 2025-02-18.", "xPost": null }, { "slug": "simplehelp-cve-2024-57727", "title": "SimpleHelp: Path Traversal Vulnerability", "url": "https://pwn.watch/i/simplehelp-cve-2024-57727", "json": "https://pwn.watch/i/simplehelp-cve-2024-57727.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SimpleHelp", "tags": [ "simplehelp", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2024-57727" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-13", "closedAt": "2025-02-13", "updatedAt": "2025-02-13", "summary": "SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords. Added to CISA KEV on 2025-02-13.", "xPost": null }, { "slug": "sophos-cyberoamos-cve-2020-29574", "title": "Sophos CyberoamOS: CyberoamOS (CROS) SQL Injection Vulnerability", "url": "https://pwn.watch/i/sophos-cyberoamos-cve-2020-29574", "json": "https://pwn.watch/i/sophos-cyberoamos-cve-2020-29574.json", "status": "closed", "severity": "critical", "patchStatus": "unpatched", "product": "Sophos CyberoamOS", "tags": [ "sophos", "ransomware", "cisa-kev", "sql-injection" ], "cveIds": [ "CVE-2020-29574" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "None: CISA says the product is end-of-life; discontinue use" ], "startedAt": "2025-02-06", "closedAt": "2025-02-06", "updatedAt": "2025-02-06", "summary": "CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely. Added to CISA KEV on 2025-02-06.", "xPost": null }, { "slug": "sonicwall-sma1000-appliances-cve-2025-23006", "title": "SonicWall SMA1000 Appliances: SMA1000 Appliances Deserialization Vulnerability", "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2025-23006", "json": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2025-23006.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SonicWall SMA1000 Appliances", "tags": [ "sonicwall", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-23006" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-24", "closedAt": "2025-01-24", "updatedAt": "2025-01-24", "summary": "SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands. Added to CISA KEV on 2025-01-24.", "xPost": null }, { "slug": "fortinet-fortios-and-fortiproxy-cve-2024-55591", "title": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591", "json": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiOS and FortiProxy", "tags": [ "fortinet", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2024-55591" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-14", "closedAt": "2025-01-14", "updatedAt": "2025-01-14", "summary": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. Added to CISA KEV on 2025-01-14.", "xPost": null }, { "slug": "qlik-sense-cve-2023-48365", "title": "Qlik Sense: Sense HTTP Tunneling Vulnerability", "url": "https://pwn.watch/i/qlik-sense-cve-2023-48365", "json": "https://pwn.watch/i/qlik-sense-cve-2023-48365.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Qlik Sense", "tags": [ "qlik", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-48365" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-13", "closedAt": "2025-01-13", "updatedAt": "2025-01-13", "summary": "Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software. Added to CISA KEV on 2025-01-13.", "xPost": null }, { "slug": "ivanti-connect-secure-zero-day-cve-2025-0282", "title": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282", "json": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Connect Secure, Policy Secure, ZTA Gateways", "tags": [ "ivanti", "vpn", "zero-day", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-0282" ], "affectedVersions": [ "Connect Secure 22.7R2 through 22.7R2.4 (Policy Secure / ZTA: see Ivanti advisory)" ], "fixedVersions": [ "Connect Secure 22.7R2.5" ], "startedAt": "2025-01-08", "closedAt": "2025-01-08", "updatedAt": "2025-01-08", "summary": "An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.", "xPost": null }, { "slug": "mitel-micollab-cve-2024-41713", "title": "Mitel MiCollab: 2 exploited vulnerabilities (CVE-2024-41713, CVE-2024-55550)", "url": "https://pwn.watch/i/mitel-micollab-cve-2024-41713", "json": "https://pwn.watch/i/mitel-micollab-cve-2024-41713.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Mitel MiCollab", "tags": [ "mitel", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2024-41713", "CVE-2024-55550" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-07", "closedAt": "2025-01-07", "updatedAt": "2025-01-07", "summary": "CVE-2024-41713: Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server. CVE-2024-55550: Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server. Added to CISA KEV on 2025-01-07.", "xPost": null }, { "slug": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "title": "Cleo file transfer zero-days exploited by Clop for data theft", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "json": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Cleo Multiple Products", "tags": [ "cleo", "zero-day", "cl0p", "file-transfer", "data-breach", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-50623", "CVE-2024-55956" ], "affectedVersions": [ "Cleo Harmony, VLTrader and LexiCom before 5.8.0.24 (Cleo)" ], "fixedVersions": [ "5.8.0.24 (Cleo, for CVE-2024-55956)", "5.8.0.21 (Cleo, for CVE-2024-50623)" ], "startedAt": "2024-12-03", "closedAt": "2024-12-17", "updatedAt": "2024-12-17", "summary": "Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "zyxel-multiple-firewalls-cve-2024-11667", "title": "Zyxel Multiple Firewalls Path Traversal", "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667", "json": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Zyxel Multiple Firewalls", "tags": [ "zyxel", "firewall", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-11667" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-27", "closedAt": "2024-12-03", "updatedAt": "2024-12-03", "summary": "Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. Added to the CISA KEV catalog on 2024-12-03. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "array-networks-ag-vxag-arrayos-cve-2023-28461", "title": "Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function", "url": "https://pwn.watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461", "json": "https://pwn.watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Array Networks AG/vxAG ArrayOS", "tags": [ "array-networks", "cisa-kev", "ransomware", "auth-bypass" ], "cveIds": [ "CVE-2023-28461" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-25", "closedAt": "2024-11-25", "updatedAt": "2024-11-25", "summary": "Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway. Added to the CISA KEV catalog on 2024-11-25. CISA lists known use in ransomware campaigns. CVE-2023-28461 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "title": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "json": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "zero-day", "auth-bypass", "firewall", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-0012", "CVE-2024-9474" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-18", "closedAt": "2024-11-18", "updatedAt": "2024-11-18", "summary": "CVE-2024-0012: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CVE-2024-9474: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Added to the CISA KEV catalog on 2024-11-18. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-zero-days-november-2024-43451-49039", "title": "Microsoft November 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039", "json": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-43451", "CVE-2024-49039" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-12", "closedAt": "2024-11-12", "updatedAt": "2024-11-12", "summary": "CVE-2024-43451: Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user. CVE-2024-49039: Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions. Added to the CISA KEV catalog on 2024-11-12. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "cyberpersons-cyberpanel-cve-2024-51567-51378", "title": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378", "json": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CyberPersons CyberPanel", "tags": [ "hosting", "cyberpanel", "cisa-kev", "ransomware", "auth-bypass" ], "cveIds": [ "CVE-2024-51567", "CVE-2024-51378" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-10-29", "closedAt": "2024-12-04", "updatedAt": "2024-12-04", "summary": "CVE-2024-51567: CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. CVE-2024-51378: CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property. Added to the CISA KEV catalog on 2024-11-07, 2024-12-04. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "mozilla-firefox-cve-2024-9680", "title": "Mozilla Firefox Use-After-Free", "url": "https://pwn.watch/i/mozilla-firefox-cve-2024-9680", "json": "https://pwn.watch/i/mozilla-firefox-cve-2024-9680.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Mozilla Firefox", "tags": [ "mozilla", "firefox", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-9680" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-10-09", "closedAt": "2024-10-15", "updatedAt": "2024-10-15", "summary": "Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process. Added to the CISA KEV catalog on 2024-10-15. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-sql-server-cve-2020-0618", "title": "Microsoft SQL Server Reporting Services Remote Code Execution", "url": "https://pwn.watch/i/microsoft-sql-server-cve-2020-0618", "json": "https://pwn.watch/i/microsoft-sql-server-cve-2020-0618.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft SQL Server", "tags": [ "microsoft", "sql-server", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2020-0618" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-18", "closedAt": "2024-09-18", "updatedAt": "2024-09-18", "summary": "Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account. Added to the CISA KEV catalog on 2024-09-18. CISA lists known use in ransomware campaigns. CVE-2020-0618 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "linux-kernel-cve-2017-1000253", "title": "Linux Kernel PIE Stack Buffer Corruption", "url": "https://pwn.watch/i/linux-kernel-cve-2017-1000253", "json": "https://pwn.watch/i/linux-kernel-cve-2017-1000253.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Linux Kernel", "tags": [ "linux", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2017-1000253" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-09", "closedAt": "2024-09-09", "updatedAt": "2024-09-09", "summary": "Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges. Added to the CISA KEV catalog on 2024-09-09. CISA lists known use in ransomware campaigns. CVE-2017-1000253 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "veeam-backup-replication-cve-2024-40711", "title": "Veeam Backup and Replication Deserialization", "url": "https://pwn.watch/i/veeam-backup-replication-cve-2024-40711", "json": "https://pwn.watch/i/veeam-backup-replication-cve-2024-40711.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Veeam Backup & Replication", "tags": [ "veeam", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-40711" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-07", "closedAt": "2024-10-17", "updatedAt": "2024-10-17", "summary": "Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution. Added to the CISA KEV catalog on 2024-10-17. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "progress-whatsup-gold-cve-2024-6670", "title": "Progress WhatsUp Gold SQL Injection", "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670", "json": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Progress WhatsUp Gold", "tags": [ "progress", "whatsup-gold", "cisa-kev", "ransomware", "sql-injection" ], "cveIds": [ "CVE-2024-6670" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-29", "closedAt": "2024-09-16", "updatedAt": "2024-09-16", "summary": "Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. Added to the CISA KEV catalog on 2024-09-16. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "sonicwall-sonicos-cve-2024-40766", "title": "SonicWall SonicOS Improper Access Control", "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-40766", "json": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-40766.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SonicWall SonicOS", "tags": [ "sonicwall", "sonicos", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-40766" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-23", "closedAt": "2024-09-09", "updatedAt": "2024-09-09", "summary": "SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash. Added to the CISA KEV catalog on 2024-09-09. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-sharepoint-cve-2024-38094", "title": "Microsoft SharePoint Deserialization", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094", "json": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint", "tags": [ "microsoft", "sharepoint", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-38094" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-09", "closedAt": "2024-10-22", "updatedAt": "2024-10-22", "summary": "Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-10-22. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "vmware-esxi-cve-2024-37085", "title": "VMware ESXi Authentication Bypass", "url": "https://pwn.watch/i/vmware-esxi-cve-2024-37085", "json": "https://pwn.watch/i/vmware-esxi-cve-2024-37085.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "VMware ESXi", "tags": [ "vmware", "esxi", "auth-bypass", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-37085" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-25", "closedAt": "2024-07-30", "updatedAt": "2024-07-30", "summary": "VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. Added to the CISA KEV catalog on 2024-07-30. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-30088", "title": "Microsoft Windows Kernel TOCTOU Race Condition", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-30088", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-30088.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-30088" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-11", "closedAt": "2024-10-15", "updatedAt": "2024-10-15", "summary": "Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation. Added to the CISA KEV catalog on 2024-10-15. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "php-cgi-argument-injection-cve-2024-4577", "title": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577", "json": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "PHP Group PHP", "tags": [ "php", "windows", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-4577" ], "affectedVersions": [ "PHP < 8.3.8, < 8.2.20, < 8.1.29 (GitHub advisory); exploitable on Windows in CGI mode" ], "fixedVersions": [ "8.3.8", "8.2.20", "8.1.29" ], "startedAt": "2024-06-06", "closedAt": "2024-06-12", "updatedAt": "2024-06-12", "summary": "A bypass of the old CVE-2012-1823 fix: on Windows, PHP's 'Best-Fit' character mapping let attackers inject arguments into PHP running in CGI mode (including default XAMPP setups) and execute code remotely. Found by Orange Tsai (DEVCORE) and fixed in PHP 8.3.8, 8.2.20 and 8.1.29. Exploitation, including by ransomware operators, followed within days. Added to the CISA KEV catalog on 2024-06-12. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "rejetto-http-file-server-cve-2024-23692", "title": "Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine", "url": "https://pwn.watch/i/rejetto-http-file-server-cve-2024-23692", "json": "https://pwn.watch/i/rejetto-http-file-server-cve-2024-23692.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Rejetto HTTP File Server", "tags": [ "rejetto", "rejetto-hfs", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-23692" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-31", "closedAt": "2024-07-09", "updatedAt": "2024-07-09", "summary": "Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request. Added to the CISA KEV catalog on 2024-07-09. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "check-point-quantum-gateway-info-disclosure-cve-2024-24919", "title": "Check Point VPN gateway arbitrary file read (CVE-2024-24919) exploited", "url": "https://pwn.watch/i/check-point-quantum-gateway-info-disclosure-cve-2024-24919", "json": "https://pwn.watch/i/check-point-quantum-gateway-info-disclosure-cve-2024-24919.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Check Point Quantum Security Gateways", "tags": [ "check-point", "vpn", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-24919" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-28", "closedAt": "2024-05-30", "updatedAt": "2024-05-30", "summary": "Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "nextgen-healthcare-mirth-connect-cve-2023-43208", "title": "NextGen Healthcare Mirth Connect Deserialization of Untrusted Data", "url": "https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208", "json": "https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "NextGen Healthcare Mirth Connect", "tags": [ "java", "nextgen-healthcare", "mirth-connect", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2023-43208" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-20", "closedAt": "2024-05-20", "updatedAt": "2024-05-20", "summary": "NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request. Added to the CISA KEV catalog on 2024-05-20. CISA lists known use in ransomware campaigns. CVE-2023-43208 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-zero-days-may-2024-30040-30051", "title": "Microsoft May 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051", "json": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft DWM Core Library, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-30040", "CVE-2024-30051" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-14", "closedAt": "2024-05-14", "updatedAt": "2024-05-14", "summary": "CVE-2024-30040: Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass. CVE-2024-30051: Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-05-14. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "title": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "json": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "zero-day", "rce", "vpn", "firewall", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-3400" ], "affectedVersions": [ "PAN-OS 10.2, 11.0 and 11.1 with GlobalProtect (exact hotfix ranges in the Palo Alto advisory)" ], "fixedVersions": [ "Hotfix releases per the Palo Alto advisory, e.g. 10.2.9-h1, 11.0.4-h1, 11.1.2-h3" ], "startedAt": "2024-04-12", "closedAt": "2024-04-12", "updatedAt": "2024-04-12", "summary": "A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-sharepoint-server-cve-2023-24955", "title": "Microsoft SharePoint Server Code Injection", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955", "json": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint Server", "tags": [ "microsoft", "sharepoint", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2023-24955" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-26", "closedAt": "2024-03-26", "updatedAt": "2024-03-26", "summary": "Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely. Added to the CISA KEV catalog on 2024-03-26. CISA lists known use in ransomware campaigns. CVE-2023-24955 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529", "title": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection", "url": "https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529", "json": "https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA)", "tags": [ "ivanti", "ivanti-epm", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2021-44529" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-25", "closedAt": "2024-03-25", "updatedAt": "2024-03-25", "summary": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody). Added to the CISA KEV catalog on 2024-03-25. CISA lists known use in ransomware campaigns. CVE-2021-44529 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "fortinet-forticlient-ems-cve-2023-48788", "title": "Fortinet FortiClient EMS SQL Injection", "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788", "json": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiClient EMS", "tags": [ "fortinet", "forticlient", "cisa-kev", "ransomware", "sql-injection" ], "cveIds": [ "CVE-2023-48788" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-12", "closedAt": "2024-03-25", "updatedAt": "2024-03-25", "summary": "Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests. Added to the CISA KEV catalog on 2024-03-25. CISA lists known use in ransomware campaigns. CVE-2023-48788 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-26169", "title": "Microsoft Windows Error Reporting Service Improper Privilege Management", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-26169", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-26169.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-26169" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-12", "closedAt": "2024-06-13", "updatedAt": "2024-06-13", "summary": "Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-06-13. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "title": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "JetBrains TeamCity", "tags": [ "devtools", "java", "jetbrains", "teamcity", "auth-bypass", "ci-cd", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-27198", "CVE-2024-27199" ], "affectedVersions": [ "TeamCity On-Premises before 2023.11.4 (JetBrains)" ], "fixedVersions": [ "2023.11.4 (JetBrains)" ], "startedAt": "2024-03-04", "closedAt": "2024-03-07", "updatedAt": "2024-03-07", "summary": "JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "change-healthcare-ransomware-attack", "title": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack", "json": "https://pwn.watch/i/change-healthcare-ransomware-attack.json", "status": "closed", "severity": "critical", "patchStatus": "no-fix-needed", "product": "Change Healthcare (UnitedHealth Group / Optum)", "tags": [ "change-healthcare", "unitedhealth", "healthcare", "ransomware", "alphv", "citrix", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-02-21", "closedAt": "2024-10-22", "updatedAt": "2024-10-22", "summary": "The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).", "xPost": null }, { "slug": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "title": "ConnectWise ScreenConnect auth bypass mass-exploited", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709", "json": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "ConnectWise ScreenConnect", "tags": [ "connectwise", "screenconnect", "auth-bypass", "remote-access", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-1709", "CVE-2024-1708" ], "affectedVersions": [ "ScreenConnect 23.9.7 and earlier (ConnectWise bulletin)" ], "fixedVersions": [ "23.9.8 (ConnectWise bulletin)" ], "startedAt": "2024-02-19", "closedAt": "2024-02-22", "updatedAt": "2024-02-22", "summary": "ConnectWise ScreenConnect before 23.9.8 had a trivially exploitable authentication bypass (CVE-2024-1709, CVSS 10) and a path traversal (CVE-2024-1708), reported to ConnectWise on 2024-02-19. Attackers could create an admin account on self-hosted servers and then push code to every managed endpoint. Exploitation began within days, including by ransomware groups. Cloud instances were patched by ConnectWise; on-premise servers had to update to 23.9.8. Added to the CISA KEV catalog on 2024-02-22. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259", "title": "Cisco ASA and FTD Information Disclosure", "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259", "json": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)", "tags": [ "cisco", "cisco-asa", "cisco-ftd", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2020-3259" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-15", "closedAt": "2024-02-15", "updatedAt": "2024-02-15", "summary": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. Added to the CISA KEV catalog on 2024-02-15. CISA lists known use in ransomware campaigns. CVE-2020-3259 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-21338", "title": "Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-21338", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-21338.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-21338" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-13", "closedAt": "2024-03-04", "updatedAt": "2024-03-04", "summary": "Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation. Added to the CISA KEV catalog on 2024-03-04. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-zero-days-february-2024-21351-21412", "title": "Microsoft February 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412", "json": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-21351", "CVE-2024-21412" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-13", "closedAt": "2024-02-13", "updatedAt": "2024-02-13", "summary": "CVE-2024-21351: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both. CVE-2024-21412: Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass. Added to the CISA KEV catalog on 2024-02-13. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "fortinet-fortios-cve-2024-21762", "title": "Fortinet FortiOS Out-of-Bound Write", "url": "https://pwn.watch/i/fortinet-fortios-cve-2024-21762", "json": "https://pwn.watch/i/fortinet-fortios-cve-2024-21762.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiOS", "tags": [ "fortinet", "fortios", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-21762" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-09", "closedAt": "2024-02-09", "updatedAt": "2024-02-09", "summary": "Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests. Added to the CISA KEV catalog on 2024-02-09. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "linux-kernel-nf-tables-use-after-free-cve-2024-1086", "title": "Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root", "url": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086", "json": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Linux Kernel", "tags": [ "linux", "privilege-escalation", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-1086" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-31", "closedAt": "2024-05-30", "updatedAt": "2024-05-30", "summary": "Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "title": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897", "json": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Jenkins Command Line Interface (CLI)", "tags": [ "devtools", "java", "jenkins", "ci-cd", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-23897" ], "affectedVersions": [ "Jenkins 2.441 and earlier, LTS 2.426.2 and earlier (Jenkins advisory)" ], "fixedVersions": [ "Jenkins 2.442", "LTS 2.426.3", "LTS 2.440.1" ], "startedAt": "2024-01-24", "closedAt": "2024-08-19", "updatedAt": "2024-08-19", "summary": "Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. Added to the CISA KEV catalog on 2024-08-19. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082", "title": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass", "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082", "json": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core", "tags": [ "ivanti", "ivanti-epmm", "cisa-kev", "ransomware", "auth-bypass" ], "cveIds": [ "CVE-2023-35082" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-18", "closedAt": "2024-01-18", "updatedAt": "2024-01-18", "summary": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application. Added to the CISA KEV catalog on 2024-01-18. CISA lists known use in ransomware campaigns. CVE-2023-35082 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "atlassian-confluence-data-center-and-server-cve-2023-22527", "title": "Atlassian Confluence Data Center and Server Template Injection", "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527", "json": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Atlassian Confluence Data Center and Server", "tags": [ "java", "atlassian", "confluence", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2023-22527" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-16", "closedAt": "2024-01-24", "updatedAt": "2024-01-24", "summary": "Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. Added to the CISA KEV catalog on 2024-01-24. CISA lists known use in ransomware campaigns. CVE-2023-22527 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "title": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "json": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and Neurons", "tags": [ "ivanti", "ivanti-connect-secure", "vpn", "zero-day", "auth-bypass", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2023-46805", "CVE-2024-21887", "CVE-2024-21893" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-10", "closedAt": "2024-01-31", "updatedAt": "2024-01-31", "summary": "Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-sharepoint-server-cve-2023-29357", "title": "Microsoft SharePoint Server Privilege Escalation", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357", "json": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft SharePoint Server", "tags": [ "microsoft", "sharepoint", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2023-29357" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-10", "closedAt": "2024-01-10", "updatedAt": "2024-01-10", "summary": "Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges. Added to the CISA KEV catalog on 2024-01-10. CISA lists known use in ransomware campaigns. CVE-2023-29357 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "adobe-coldfusion-cve-2023-29300-38203", "title": "Adobe ColdFusion: 2 actively exploited vulnerabilities", "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203", "json": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Adobe ColdFusion", "tags": [ "adobe", "coldfusion", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2023-29300", "CVE-2023-38203" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-08", "closedAt": "2024-01-08", "updatedAt": "2024-01-08", "summary": "CVE-2023-29300: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CVE-2023-38203: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. Added to the CISA KEV catalog on 2024-01-08. CISA lists known use in ransomware campaigns. CVE-2023-29300, CVE-2023-38203 were assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "qlik-sense-cve-2023-41265-41266", "title": "Qlik Sense: 2 exploited vulnerabilities (CVE-2023-41265, CVE-2023-41266)", "url": "https://pwn.watch/i/qlik-sense-cve-2023-41265-41266", "json": "https://pwn.watch/i/qlik-sense-cve-2023-41265-41266.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Qlik Sense", "tags": [ "qlik", "ransomware", "cisa-kev", "path-traversal" ], "cveIds": [ "CVE-2023-41265", "CVE-2023-41266" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-12-07", "closedAt": "2023-12-07", "updatedAt": "2023-12-07", "summary": "Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software. Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints. Added to CISA KEV on 2023-12-07. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "sysaid-server-cve-2023-47246", "title": "SysAid Server: Path Traversal (CVE-2023-47246)", "url": "https://pwn.watch/i/sysaid-server-cve-2023-47246", "json": "https://pwn.watch/i/sysaid-server-cve-2023-47246.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SysAid Server", "tags": [ "sysaid", "ransomware", "cisa-kev", "path-traversal" ], "cveIds": [ "CVE-2023-47246" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-11-13", "closedAt": "2023-11-13", "updatedAt": "2023-11-13", "summary": "SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution. Added to CISA KEV on 2023-11-13. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "atlassian-confluence-improper-authorization-cve-2023-22518", "title": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518", "json": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Atlassian Confluence Data Center and Server", "tags": [ "java", "atlassian", "confluence", "auth-bypass", "ransomware", "cerber", "cisa-kev" ], "cveIds": [ "CVE-2023-22518" ], "affectedVersions": [ "All versions of Confluence Data Center and Server before the fixed releases (NVD)" ], "fixedVersions": [ "7.19.16", "8.3.4", "8.4.4", "8.5.3", "8.6.1" ], "startedAt": "2023-10-31", "closedAt": "2023-11-07", "updatedAt": "2023-11-07", "summary": "An improper authorization bug let unauthenticated attackers reset Confluence Data Center and Server and create a new admin. Within days of disclosure it was exploited to deploy Cerber ransomware. Atlassian Cloud was not affected.", "xPost": null }, { "slug": "f5-big-ip-configuration-utility-cve-2023-46747-46748", "title": "F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)", "url": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748", "json": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "F5 BIG-IP Configuration Utility", "tags": [ "f5", "ransomware", "cisa-kev", "sql-injection", "auth-bypass" ], "cveIds": [ "CVE-2023-46747", "CVE-2023-46748" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-10-31", "closedAt": "2023-10-31", "updatedAt": "2023-10-31", "summary": "F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748. F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747. Added to CISA KEV on 2023-10-31. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "apache-activemq-openwire-rce-cve-2023-46604", "title": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604", "json": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Apache ActiveMQ (Java OpenWire brokers and clients)", "tags": [ "java", "apache", "activemq", "rce", "deserialization", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-46604" ], "affectedVersions": [ "See vendor advisory" ], "fixedVersions": [ "5.15.16", "5.16.7", "5.17.6", "5.18.3" ], "startedAt": "2023-10-27", "closedAt": "2023-11-02", "updatedAt": "2023-11-02", "summary": "A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.", "xPost": null }, { "slug": "citrix-bleed-netscaler-cve-2023-4966", "title": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966", "json": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Citrix NetScaler ADC and NetScaler Gateway", "tags": [ "citrix", "netscaler", "zero-day", "session-hijacking", "lockbit", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-4966" ], "affectedVersions": [ "NetScaler ADC and Gateway configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (NVD); exact builds: see vendor advisory" ], "fixedVersions": [ "14.1-8.50", "13.1-49.15", "13.0-92.19", "FIPS/NDcPP builds: see vendor advisory" ], "startedAt": "2023-10-10", "closedAt": "2023-11-21", "updatedAt": "2023-12-18", "summary": "A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users).", "xPost": null }, { "slug": "progress-ws-ftp-server-cve-2023-40044", "title": "Progress WS_FTP Server: Deserialization of Untrusted Data (CVE-2023-40044)", "url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044", "json": "https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Progress WS_FTP Server", "tags": [ "progress", "ransomware", "cisa-kev", "deserialization" ], "cveIds": [ "CVE-2023-40044" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-10-05", "closedAt": "2023-10-05", "updatedAt": "2023-10-05", "summary": "Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. Added to CISA KEV on 2023-10-05. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "cisco-adaptive-security-appliance-and-threat-cve-2023-20269", "title": "Cisco Adaptive Security Appliance and Firepower Threat Defense: Unauthorized Access (CVE-2023-20269)", "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-and-threat-cve-2023-20269", "json": "https://pwn.watch/i/cisco-adaptive-security-appliance-and-threat-cve-2023-20269.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Cisco Adaptive Security Appliance and Firepower Threat Defense", "tags": [ "cisco", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-20269" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-09-13", "closedAt": "2023-09-13", "updatedAt": "2023-09-13", "summary": "Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user. Added to CISA KEV on 2023-09-13. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "mgm-resorts-caesars-scattered-spider-2023", "title": "MGM Resorts and Caesars hit by Scattered Spider", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023", "json": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "MGM Resorts International; Caesars Entertainment", "tags": [ "mgm-resorts", "caesars", "scattered-spider", "alphv", "ransomware", "social-engineering", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-09-07", "closedAt": "2023-10-05", "updatedAt": "2023-10-05", "summary": "Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.", "xPost": null }, { "slug": "ivanti-sentry-cve-2023-38035", "title": "Ivanti Sentry: Authentication Bypass (CVE-2023-38035)", "url": "https://pwn.watch/i/ivanti-sentry-cve-2023-38035", "json": "https://pwn.watch/i/ivanti-sentry-cve-2023-38035.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Sentry", "tags": [ "ivanti", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2023-38035" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-08-22", "closedAt": "2023-08-22", "updatedAt": "2023-08-22", "summary": "Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. Added to CISA KEV on 2023-08-22. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "veeam-backup-replication-cve-2023-27532", "title": "Veeam Backup & Replication: Cloud Connect Missing Authentication for Critical Function (CVE-2023-27532)", "url": "https://pwn.watch/i/veeam-backup-replication-cve-2023-27532", "json": "https://pwn.watch/i/veeam-backup-replication-cve-2023-27532.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Veeam Backup & Replication", "tags": [ "veeam", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2023-27532" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-08-22", "closedAt": "2023-08-22", "updatedAt": "2023-08-22", "summary": "Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts. Added to CISA KEV on 2023-08-22. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-36884", "title": "Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36884", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-36884.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-36884" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-07-17", "closedAt": "2023-07-17", "updatedAt": "2023-07-17", "summary": "Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution. Added to CISA KEV on 2023-07-17. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "netwrix-auditor-cve-2022-31199", "title": "Netwrix Auditor: Insecure Object Deserialization (CVE-2022-31199)", "url": "https://pwn.watch/i/netwrix-auditor-cve-2022-31199", "json": "https://pwn.watch/i/netwrix-auditor-cve-2022-31199.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Netwrix Auditor", "tags": [ "netwrix", "ransomware", "cisa-kev", "deserialization" ], "cveIds": [ "CVE-2022-31199" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-07-11", "closedAt": "2023-07-11", "updatedAt": "2023-07-11", "summary": "Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling. Added to CISA KEV on 2023-07-11. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "moveit-transfer-cl0p-mass-exploitation-2023", "title": "MOVEit Transfer zero-day: Cl0p mass data theft", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023", "json": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Progress MOVEit Transfer", "tags": [ "progress", "moveit", "cl0p", "zero-day", "sql-injection", "data-breach", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-34362", "CVE-2023-35036", "CVE-2023-35708" ], "affectedVersions": [ "CVE-2023-34362: before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), 2023.0.1 (15.0.1) (NVD)", "CVE-2023-35036: before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), 2023.0.2 (15.0.2) (NVD)", "CVE-2023-35708: before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3) (NVD)" ], "fixedVersions": [ "2021.0.8 (13.0.8)", "2021.1.6 (13.1.6)", "2022.0.6 (14.0.6)", "2022.1.7 (14.1.7)", "2023.0.3 (15.0.3)", "Older branches: see vendor advisory" ], "startedAt": "2023-05-27", "closedAt": "2023-06-16", "updatedAt": "2023-06-16", "summary": "Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.", "xPost": null }, { "slug": "papercut-mf-ng-auth-bypass-cve-2023-27350", "title": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)", "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350", "json": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "PaperCut MF and PaperCut NG", "tags": [ "papercut", "auth-bypass", "rce", "cl0p", "lockbit", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-27350" ], "affectedVersions": [ "See vendor advisory" ], "fixedVersions": [ "20.1.7", "21.2.11", "22.0.9" ], "startedAt": "2023-04-21", "closedAt": "2023-05-11", "updatedAt": "2023-05-11", "summary": "An improper access control bug in PaperCut NG/MF print management let unauthenticated attackers run code as SYSTEM. Fixes had shipped in March 2023, but unpatched servers were exploited from April. Microsoft linked it to Cl0p (Lace Tempest) and LockBit, and the Bl00dy gang hit schools with it.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-28252", "title": "Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-28252", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-28252.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-28252" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-04-11", "closedAt": "2023-04-11", "updatedAt": "2023-04-11", "summary": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-04-11. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-24880", "title": "Microsoft Windows: SmartScreen Security Feature Bypass (CVE-2023-24880)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-24880", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-24880.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-24880" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-03-14", "closedAt": "2023-03-14", "updatedAt": "2023-03-14", "summary": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. Added to CISA KEV on 2023-03-14. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "zk-framework-auuploader-cve-2022-36537", "title": "ZK Framework AuUploader: Unspecified (CVE-2022-36537)", "url": "https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537", "json": "https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "ZK Framework AuUploader", "tags": [ "java", "zk-framework", "connectwise", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2022-36537" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-27", "closedAt": "2023-02-27", "updatedAt": "2023-02-27", "summary": "ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. Added to CISA KEV on 2023-02-27. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "ibm-aspera-faspex-cve-2022-47986", "title": "IBM Aspera Faspex: Code Execution (CVE-2022-47986)", "url": "https://pwn.watch/i/ibm-aspera-faspex-cve-2022-47986", "json": "https://pwn.watch/i/ibm-aspera-faspex-cve-2022-47986.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "IBM Aspera Faspex", "tags": [ "ibm", "ransomware", "cisa-kev", "deserialization" ], "cveIds": [ "CVE-2022-47986" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-21", "closedAt": "2023-02-21", "updatedAt": "2023-02-21", "summary": "IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. Added to CISA KEV on 2023-02-21. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "mitel-mivoice-connect-cve-2022-40765-41223", "title": "Mitel MiVoice Connect: 2 exploited vulnerabilities (CVE-2022-40765, CVE-2022-41223)", "url": "https://pwn.watch/i/mitel-mivoice-connect-cve-2022-40765-41223", "json": "https://pwn.watch/i/mitel-mivoice-connect-cve-2022-40765-41223.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Mitel MiVoice Connect", "tags": [ "mitel", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2022-40765", "CVE-2022-41223" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-21", "closedAt": "2023-02-21", "updatedAt": "2023-02-21", "summary": "The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system. The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application. Added to CISA KEV on 2023-02-21. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-21823-23376", "title": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-21823", "CVE-2023-23376" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-14", "closedAt": "2023-02-14", "updatedAt": "2023-02-14", "summary": "Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-02-14. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "terramaster-os-cve-2022-24990", "title": "TerraMaster OS: Remote Command Execution (CVE-2022-24990)", "url": "https://pwn.watch/i/terramaster-os-cve-2022-24990", "json": "https://pwn.watch/i/terramaster-os-cve-2022-24990.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "TerraMaster OS", "tags": [ "terramaster", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2022-24990" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-10", "closedAt": "2023-02-10", "updatedAt": "2023-02-10", "summary": "TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint. Added to CISA KEV on 2023-02-10. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "oracle-e-business-suite-cve-2022-21587", "title": "Oracle E-Business Suite: Unspecified (CVE-2022-21587)", "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2022-21587", "json": "https://pwn.watch/i/oracle-e-business-suite-cve-2022-21587.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle E-Business Suite", "tags": [ "oracle", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2022-21587" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-02", "closedAt": "2023-02-02", "updatedAt": "2023-02-02", "summary": "Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Added to CISA KEV on 2023-02-02. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "goanywhere-mft-cl0p-cve-2023-0669", "title": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669", "json": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Fortra GoAnywhere MFT", "tags": [ "fortra", "goanywhere", "cl0p", "zero-day", "rce", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-0669" ], "affectedVersions": [ "Before 7.1.2 (NVD)" ], "fixedVersions": [ "7.1.2" ], "startedAt": "2023-02-01", "closedAt": "2023-02-10", "updatedAt": "2023-02-10", "summary": "A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.", "xPost": null }, { "slug": "zoho-manageengine-cve-2022-47966", "title": "Zoho ManageEngine: Remote Code Execution (CVE-2022-47966)", "url": "https://pwn.watch/i/zoho-manageengine-cve-2022-47966", "json": "https://pwn.watch/i/zoho-manageengine-cve-2022-47966.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Zoho ManageEngine", "tags": [ "zoho", "ransomware", "cisa-kev", "rce", "manageengine" ], "cveIds": [ "CVE-2022-47966" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-01-23", "closedAt": "2023-01-23", "updatedAt": "2023-01-23", "summary": "Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario. Added to CISA KEV on 2023-01-23. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-exchange-server-cve-2022-41080", "title": "Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)", "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080", "json": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Exchange Server", "tags": [ "microsoft", "ransomware", "cisa-kev", "rce", "privilege-escalation" ], "cveIds": [ "CVE-2022-41080" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-01-10", "closedAt": "2023-01-10", "updatedAt": "2023-01-10", "summary": "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution. Added to CISA KEV on 2023-01-10. CISA lists known use in ransomware campaigns.", "xPost": null } ], "posts": [], "changes": [ { "incident": "broadcom-vmware-vcenter-cve-2026-59310", "incidentTitle": "Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-18", "title": "CISA added CVE-2026-59310 to the KEV catalog (due 2026-08-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310" }, { "incident": "jetbrains-teamcity-cve-2026-63077", "incidentTitle": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-05", "title": "CISA added CVE-2026-63077 to the KEV catalog (due 2026-08-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077" }, { "incident": "cisco-secure-firewall-management-center-fmc-cve-2026-20316", "incidentTitle": "Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-29", "title": "CISA added CVE-2026-20316 to the KEV catalog (due 2026-08-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316" }, { "incident": "sonicwall-sma1000-appliances-cve-2026-15409", "incidentTitle": "SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-14", "title": "CISA added CVE-2026-15409, CVE-2026-15410 to the KEV catalog (due 2026-07-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-15409" }, { "incident": "microsoft-sharepoint-server-cve-2026-45659", "incidentTitle": "Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-01", "title": "CISA added CVE-2026-45659 to the KEV catalog (due 2026-07-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659" }, { "incident": "ptc-windchill-and-flexplm-cve-2026-12569", "incidentTitle": "PTC Windchill and FlexPLM: PTC Windchill and FlexPLM Improper Input Validation Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-25", "title": "CISA added CVE-2026-12569 to the KEV catalog (due 2026-06-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ptc-windchill-and-flexplm-cve-2026-12569" }, { "incident": "oracle-peoplesoft-enterprise-peopletools-cve-2026-35273", "incidentTitle": "Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-12", "title": "CISA added CVE-2026-35273 to the KEV catalog (due 2026-06-15).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273" }, { "incident": "check-point-security-gateway-cve-2026-50751", "incidentTitle": "Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-08", "title": "CISA added CVE-2026-50751 to the KEV catalog (due 2026-06-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/check-point-security-gateway-cve-2026-50751" }, { "incident": "palo-alto-networks-pan-os-cve-2026-0257", "incidentTitle": "Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-29", "title": "CISA added CVE-2026-0257 to the KEV catalog (due 2026-06-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257" }, { "incident": "nx-nx-console-cve-2026-48027", "incidentTitle": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-27", "title": "CISA added CVE-2026-48027 to the KEV catalog (due 2026-06-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027" }, { "incident": "tanstack-tanstack-cve-2026-45321", "incidentTitle": "TanStack TanStack: TanStack Unspecified Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-27", "title": "CISA added CVE-2026-45321 to the KEV catalog (due 2026-06-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321" }, { "incident": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940", "incidentTitle": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-30", "title": "CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940" }, { "incident": "microsoft-defender-cve-2026-33825", "incidentTitle": "Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-22", "title": "CISA added CVE-2026-33825 to the KEV catalog (due 2026-05-06).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-defender-cve-2026-33825" }, { "incident": "microsoft-windows-cve-2025-60710", "incidentTitle": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-13", "title": "CISA added CVE-2025-60710, CVE-2023-36424 to the KEV catalog (due 2026-04-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-60710" }, { "incident": "cisco-secure-firewall-management-center-fmc-cve-2026-20131", "incidentTitle": "Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-19", "title": "CISA added CVE-2026-20131 to the KEV catalog (due 2026-03-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131" }, { "incident": "solarwinds-web-help-desk-cve-2025-26399", "incidentTitle": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-09", "title": "CISA added CVE-2025-26399 to the KEV catalog (due 2026-03-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-26399" }, { "incident": "beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731", "incidentTitle": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-13", "title": "CISA added CVE-2026-1731 to the KEV catalog (due 2026-02-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731" }, { "incident": "smartertools-smartermail-cve-2026-24423", "incidentTitle": "SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-05", "title": "CISA added CVE-2026-24423 to the KEV catalog (due 2026-02-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/smartertools-smartermail-cve-2026-24423" }, { "incident": "smartertools-smartermail-cve-2025-52691", "incidentTitle": "SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-26", "title": "CISA added CVE-2025-52691, CVE-2026-23760 to the KEV catalog (due 2026-02-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/smartertools-smartermail-cve-2025-52691" }, { "incident": "watchguard-firebox-cve-2025-14733", "incidentTitle": "WatchGuard Firebox: Firebox Out of Bounds Write Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-19", "title": "CISA added CVE-2025-14733 to the KEV catalog (due 2025-12-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/watchguard-firebox-cve-2025-14733" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-12", "title": "Unit 42 updates its threat brief on ongoing exploitation", "body": null, "sourceUrl": "https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-05", "title": "CISA adds CVE-2025-55182 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-03", "title": "React discloses a critical vulnerability in React Server Components and ships fixes", "body": null, "sourceUrl": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-03", "title": "AWS sees China-nexus groups exploiting it within hours", "body": "Including Earth Lamia and Jackpot Panda.", "sourceUrl": "https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "jaguar-land-rover-cyberattack-production-shutdown-2025", "incidentTitle": "Jaguar Land Rover cyberattack stops car production for five weeks", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-11-14", "title": "UK production returns to normal", "body": null, "sourceUrl": "https://www.reuters.com/business/retail-consumer/jaguar-land-rovers-uk-production-returns-normal-after-weeks-long-cyber-shutdown-2025-11-14/", "url": "https://pwn.watch/i/jaguar-land-rover-cyberattack-production-shutdown-2025" }, { "incident": "oracle-e-business-suite-cve-2025-61884", "incidentTitle": "Oracle E-Business Suite: E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-20", "title": "CISA added CVE-2025-61884 to the KEV catalog (due 2025-11-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2025-61884" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-20", "title": "CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "jaguar-land-rover-cyberattack-production-shutdown-2025", "incidentTitle": "Jaguar Land Rover cyberattack stops car production for five weeks", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-08", "title": "Phased manufacturing restart begins", "body": null, "sourceUrl": "https://www.jlr.com/news/2025/10/jlr-restarts-manufacturing-and-introduces-new-financing-solution-pay-jlr-suppliers", "url": "https://pwn.watch/i/jaguar-land-rover-cyberattack-production-shutdown-2025" }, { "incident": "asahi-ransomware-qilin-september-2025", "incidentTitle": "Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it)", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-07", "title": "Qilin claims responsibility and leaks data", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/qilin-ransomware-claims-asahi-brewery-attack-leaks-data/", "url": "https://pwn.watch/i/asahi-ransomware-qilin-september-2025" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2011-3402 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2013-3918 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2021-43226 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA adds CVE-2025-61882 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-04", "title": "Oracle publishes a Security Alert for CVE-2025-61882", "body": null, "sourceUrl": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "asahi-ransomware-qilin-september-2025", "incidentTitle": "Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it)", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-03", "title": "Asahi confirms ransomware and possible data exfiltration", "body": null, "sourceUrl": "https://www.asahigroup-holdings.com/en/newsroom/detail/20251003-0204.html", "url": "https://pwn.watch/i/asahi-ransomware-qilin-september-2025" }, { "incident": "fortra-goanywhere-mft-cve-2025-10035", "incidentTitle": "Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-29", "title": "CISA added CVE-2025-10035 to the KEV catalog (due 2025-10-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-29", "title": "Cl0p-branded extortion emails start arriving at executives", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "asahi-ransomware-qilin-september-2025", "incidentTitle": "Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it)", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-09-29", "title": "Cyberattack halts orders, shipments and call centres in Japan", "body": null, "sourceUrl": "https://www.bloomberg.com/news/articles/2025-09-29/cyberattack-disrupts-asahi-group-suspending-some-shipments", "url": "https://pwn.watch/i/asahi-ransomware-qilin-september-2025" }, { "incident": "jaguar-land-rover-cyberattack-production-shutdown-2025", "incidentTitle": "Jaguar Land Rover cyberattack stops car production for five weeks", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-09-28", "title": "UK government guarantees a £1.5B loan to support JLR and suppliers", "body": null, "sourceUrl": "https://www.bbc.co.uk/news/articles/cgl15ykerlro", "url": "https://pwn.watch/i/jaguar-land-rover-cyberattack-production-shutdown-2025" }, { "incident": "collins-aerospace-muse-ransomware-airports-2025", "incidentTitle": "Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-09-24", "title": "Collins works on restoring software for affected airlines", "body": null, "sourceUrl": "https://www.reuters.com/business/aerospace-defense/collins-aerospace-working-restoring-software-airlines-hit-by-cyber-attack-2025-09-24/", "url": "https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025" }, { "incident": "collins-aerospace-muse-ransomware-airports-2025", "incidentTitle": "Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-09-22", "title": "ENISA confirms third-party ransomware behind the disruption", "body": null, "sourceUrl": "https://www.reuters.com/business/aerospace-defense/eu-agency-says-third-party-ransomware-behind-airport-disruptions-2025-09-22/", "url": "https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025" }, { "incident": "collins-aerospace-muse-ransomware-airports-2025", "incidentTitle": "Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-09-20", "title": "Disruption expected to stretch into Sunday; Brussels cancels flights", "body": null, "sourceUrl": "https://www.reuters.com/en/cyberattack-causes-flight-delays-cancellations-brussels-airport-2025-09-20/", "url": "https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025" }, { "incident": "collins-aerospace-muse-ransomware-airports-2025", "incidentTitle": "Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-09-19", "title": "MUSE outage begins; Heathrow, Brussels and Berlin switch to manual check-in", "body": null, "sourceUrl": "https://www.npr.org/2025/09/20/g-s1-89727/cyberattack-european-airports", "url": "https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025" }, { "incident": "jaguar-land-rover-cyberattack-production-shutdown-2025", "incidentTitle": "Jaguar Land Rover cyberattack stops car production for five weeks", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-08-31", "title": "Cyberattack begins; production halted from September 1", "body": null, "sourceUrl": "https://www.reuters.com/business/retail-consumer/jaguar-land-rovers-uk-production-returns-normal-after-weeks-long-cyber-shutdown-2025-11-14/", "url": "https://pwn.watch/i/jaguar-land-rover-cyberattack-production-shutdown-2025" }, { "incident": "rarlab-winrar-cve-2025-8088", "incidentTitle": "RARLAB WinRAR: WinRAR Path Traversal Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-12", "title": "CISA added CVE-2025-8088 to the KEV catalog (due 2025-09-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/rarlab-winrar-cve-2025-8088" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-22", "title": "Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603", "body": "Storm-2603 deployed Warlock ransomware.", "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-22", "title": "CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-20", "title": "CISA adds CVE-2025-53770 to KEV and publishes guidance", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-19", "title": "Microsoft publishes customer guidance for CVE-2025-53770", "body": "Apply updates, enable AMSI Full Mode, deploy Defender/EDR, rotate ASP.NET machine keys and restart IIS.", "sourceUrl": "https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-18", "title": "Eye Security observes large-scale exploitation of on-prem SharePoint servers", "body": "Later clarified as the original ToolShell chain (CVE-2025-49706 + CVE-2025-49704).", "sourceUrl": "https://research.eye.security/sharepoint-under-siege/", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "citrixbleed-2-netscaler-cve-2025-5777", "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-10", "title": "CISA adds CVE-2025-5777 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777" }, { "incident": "ingram-micro-safepay-ransomware-july-2025", "incidentTitle": "Ingram Micro SafePay ransomware takes down ordering systems for a week", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-07-09", "title": "Order processing restored globally", "body": null, "sourceUrl": "https://www.ingrammicro.com/en-us/2025cybersecurityincident", "url": "https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025" }, { "incident": "ingram-micro-safepay-ransomware-july-2025", "incidentTitle": "Ingram Micro SafePay ransomware takes down ordering systems for a week", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-07-05", "title": "Ingram Micro confirms ransomware on internal systems (8-K)", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1897762/000162828025034372/ingm-20250705.htm", "url": "https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025" }, { "incident": "citrixbleed-2-netscaler-cve-2025-5777", "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-04", "title": "watchTowr publishes technical analysis; public PoCs follow", "body": null, "sourceUrl": "https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/", "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777" }, { "incident": "ingram-micro-safepay-ransomware-july-2025", "incidentTitle": "Ingram Micro SafePay ransomware takes down ordering systems for a week", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-07-03", "title": "Outage begins across website and ordering systems", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/ingram-micro-outage-caused-by-safepay-ransomware-attack/", "url": "https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025" }, { "incident": "citrixbleed-2-netscaler-cve-2025-5777", "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-26", "title": "ReliaQuest reports likely targeted exploitation", "body": null, "sourceUrl": "https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/", "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777" }, { "incident": "fortinet-fortios-cve-2019-6693", "incidentTitle": "Fortinet FortiOS: FortiOS Use of Hard-Coded Credentials Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-25", "title": "CISA added CVE-2019-6693 to the KEV catalog (due 2025-07-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-fortios-cve-2019-6693" }, { "incident": "citrixbleed-2-netscaler-cve-2025-5777", "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-23", "title": "GreyNoise observes exploitation starting", "body": null, "sourceUrl": "https://www.greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poc", "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777" }, { "incident": "citrixbleed-2-netscaler-cve-2025-5777", "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-17", "title": "Citrix discloses CVE-2025-5777 and releases fixes", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777" }, { "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025", "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-06-10", "title": "Online clothing orders resume after 46 days", "body": null, "sourceUrl": "https://www.reuters.com/business/retail-consumer/uks-ms-resumes-online-orders-following-cyber-incident-2025-06-10/", "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025" }, { "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025", "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-05-21", "title": "M&S estimates about £300M cost; disruption to last into July", "body": null, "sourceUrl": "https://www.reuters.com/business/media-telecom/britains-ms-says-cyberattack-cost-400-million-2025-05-21/", "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025" }, { "incident": "sap-netweaver-cve-2025-42999", "incidentTitle": "SAP NetWeaver: NetWeaver Deserialization Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-05-15", "title": "CISA added CVE-2025-42999 to the KEV catalog (due 2025-06-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sap-netweaver-cve-2025-42999" }, { "incident": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "incidentTitle": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-05-15", "title": "CISA adds the related NetWeaver flaw CVE-2025-42999 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324" }, { "incident": "langflow-cve-2025-3248", "incidentTitle": "Langflow: Missing Authentication Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-05-05", "title": "CISA added CVE-2025-3248 to the KEV catalog (due 2025-05-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-cve-2025-3248" }, { "incident": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "incidentTitle": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-29", "title": "CISA adds CVE-2025-31324 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324" }, { "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025", "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-04-29", "title": "Attack linked to Scattered Spider and DragonForce ransomware on ESXi", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/", "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025" }, { "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025", "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-04-25", "title": "M&S pauses online orders after a cyber incident", "body": null, "sourceUrl": "https://www.reuters.com/business/retail-consumer/britains-ms-pauses-some-online-orders-after-cyber-incident-2025-04-25/", "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025" }, { "incident": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "incidentTitle": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-24", "title": "SAP releases an emergency fix; ReliaQuest publishes its findings", "body": null, "sourceUrl": "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/", "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324" }, { "incident": "microsoft-windows-cve-2025-29824", "incidentTitle": "Microsoft Windows: Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-08", "title": "CISA added CVE-2025-29824 to the KEV catalog (due 2025-04-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-29824" }, { "incident": "crushftp-cve-2025-31161", "incidentTitle": "CrushFTP: Authentication Bypass Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-07", "title": "CISA added CVE-2025-31161 to the KEV catalog (due 2025-04-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/crushftp-cve-2025-31161" }, { "incident": "ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457", "incidentTitle": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-04", "title": "CISA added CVE-2025-22457 to the KEV catalog (due 2025-04-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457" }, { "incident": "fortinet-fortios-and-fortiproxy-cve-2025-24472", "incidentTitle": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-18", "title": "CISA added CVE-2025-24472 to the KEV catalog (due 2025-04-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24983 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24984 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24985 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24991 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24993 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-26633 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "vmware-esxi-cve-2025-22225", "incidentTitle": "VMware ESXi: ESXi Arbitrary Write Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-04", "title": "CISA added CVE-2025-22225 to the KEV catalog (due 2025-03-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/vmware-esxi-cve-2025-22225" }, { "incident": "microsoft-windows-cve-2018-8639", "incidentTitle": "Microsoft Windows: Windows Win32k Improper Resource Shutdown or Release Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-03", "title": "CISA added CVE-2018-8639 to the KEV catalog (due 2025-03-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2018-8639" }, { "incident": "sonicwall-sonicos-cve-2024-53704", "incidentTitle": "SonicWall SonicOS: SonicOS SSLVPN Improper Authentication Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-02-18", "title": "CISA added CVE-2024-53704 to the KEV catalog (due 2025-03-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704" }, { "incident": "simplehelp-cve-2024-57727", "incidentTitle": "SimpleHelp: Path Traversal Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-02-13", "title": "CISA added CVE-2024-57727 to the KEV catalog (due 2025-03-06).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/simplehelp-cve-2024-57727" }, { "incident": "sophos-cyberoamos-cve-2020-29574", "incidentTitle": "Sophos CyberoamOS: CyberoamOS (CROS) SQL Injection Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "unpatched", "date": "2025-02-06", "title": "CISA added CVE-2020-29574 to the KEV catalog (due 2025-02-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sophos-cyberoamos-cve-2020-29574" }, { "incident": "sonicwall-sma1000-appliances-cve-2025-23006", "incidentTitle": "SonicWall SMA1000 Appliances: SMA1000 Appliances Deserialization Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-24", "title": "CISA added CVE-2025-23006 to the KEV catalog (due 2025-02-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2025-23006" }, { "incident": "fortinet-fortios-and-fortiproxy-cve-2024-55591", "incidentTitle": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-14", "title": "CISA added CVE-2024-55591 to the KEV catalog (due 2025-01-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591" }, { "incident": "qlik-sense-cve-2023-48365", "incidentTitle": "Qlik Sense: Sense HTTP Tunneling Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-13", "title": "CISA added CVE-2023-48365 to the KEV catalog (due 2025-02-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/qlik-sense-cve-2023-48365" }, { "incident": "ivanti-connect-secure-zero-day-cve-2025-0282", "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-08", "title": "Ivanti discloses CVE-2025-0282 and ships Connect Secure 22.7R2.5", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/ivanti-warns-of-new-connect-secure-flaw-used-in-zero-day-attacks/", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282" }, { "incident": "ivanti-connect-secure-zero-day-cve-2025-0282", "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-08", "title": "Mandiant reports zero-day exploitation since mid-December 2024 with SPAWN malware", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day/", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282" }, { "incident": "ivanti-connect-secure-zero-day-cve-2025-0282", "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-08", "title": "CISA adds CVE-2025-0282 to KEV and publishes mitigation instructions", "body": null, "sourceUrl": "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282" }, { "incident": "mitel-micollab-cve-2024-41713", "incidentTitle": "Mitel MiCollab: 2 exploited vulnerabilities (CVE-2024-41713, CVE-2024-55550)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-07", "title": "CISA added CVE-2024-41713 to the KEV catalog (due 2025-01-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/mitel-micollab-cve-2024-41713" }, { "incident": "mitel-micollab-cve-2024-41713", "incidentTitle": "Mitel MiCollab: 2 exploited vulnerabilities (CVE-2024-41713, CVE-2024-55550)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-07", "title": "CISA added CVE-2024-55550 to the KEV catalog (due 2025-01-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/mitel-micollab-cve-2024-41713" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-17", "title": "CISA added CVE-2024-55956 to the KEV catalog (federal deadline 2025-01-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-16", "title": "Clop claims responsibility for the Cleo data-theft attacks", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-cleo-data-theft-attacks/", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-14", "title": "Cleo advisory: patch 5.8.0.24 for CVE-2024-55956", "body": null, "sourceUrl": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-13", "title": "CVE-2024-55956 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-55956", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-13", "title": "CISA added CVE-2024-50623 to the KEV catalog (federal deadline 2025-01-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-09", "title": "Huntress warns that fully patched 5.8.0.21 systems are still exploitable", "body": null, "sourceUrl": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-04", "title": "CISA added CVE-2024-51378 to the KEV catalog (federal deadline 2024-12-25)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-03", "title": "Earliest exploitation Huntress observed against Cleo servers", "body": null, "sourceUrl": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "zyxel-multiple-firewalls-cve-2024-11667", "incidentTitle": "Zyxel Multiple Firewalls Path Traversal", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-03", "title": "CISA added CVE-2024-11667 to the KEV catalog (federal deadline 2024-12-24)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667" }, { "incident": "zyxel-multiple-firewalls-cve-2024-11667", "incidentTitle": "Zyxel Multiple Firewalls Path Traversal", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-27", "title": "CVE-2024-11667 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-11667", "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667" }, { "incident": "array-networks-ag-vxag-arrayos-cve-2023-28461", "incidentTitle": "Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-25", "title": "CISA added CVE-2023-28461 to the KEV catalog (federal deadline 2024-12-16)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CVE-2024-0012 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-0012", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CVE-2024-9474 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9474", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CISA added CVE-2024-0012 to the KEV catalog (federal deadline 2024-12-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CISA added CVE-2024-9474 to the KEV catalog (federal deadline 2024-12-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CVE-2024-43451 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43451", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CVE-2024-49039 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-49039", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CISA added CVE-2024-43451 to the KEV catalog (federal deadline 2024-12-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CISA added CVE-2024-49039 to the KEV catalog (federal deadline 2024-12-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-07", "title": "CISA added CVE-2024-51567 to the KEV catalog (federal deadline 2024-11-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-29", "title": "CVE-2024-51567 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-51567", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-29", "title": "CVE-2024-51378 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-51378", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-27", "title": "CVE-2024-50623 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-50623", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "microsoft-sharepoint-cve-2024-38094", "incidentTitle": "Microsoft SharePoint Deserialization", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-22", "title": "CISA added CVE-2024-38094 to the KEV catalog (federal deadline 2024-11-12)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-10-22", "title": "Change Healthcare tells HHS OCR it has sent about 100 million individual notices", "body": null, "sourceUrl": "https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "veeam-backup-replication-cve-2024-40711", "incidentTitle": "Veeam Backup and Replication Deserialization", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-17", "title": "CISA added CVE-2024-40711 to the KEV catalog (federal deadline 2024-11-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/veeam-backup-replication-cve-2024-40711" }, { "incident": "mozilla-firefox-cve-2024-9680", "incidentTitle": "Mozilla Firefox Use-After-Free", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-15", "title": "CISA added CVE-2024-9680 to the KEV catalog (federal deadline 2024-11-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/mozilla-firefox-cve-2024-9680" }, { "incident": "microsoft-windows-cve-2024-30088", "incidentTitle": "Microsoft Windows Kernel TOCTOU Race Condition", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-15", "title": "CISA added CVE-2024-30088 to the KEV catalog (federal deadline 2024-11-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-30088" }, { "incident": "mozilla-firefox-cve-2024-9680", "incidentTitle": "Mozilla Firefox Use-After-Free", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-09", "title": "CVE-2024-9680 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9680", "url": "https://pwn.watch/i/mozilla-firefox-cve-2024-9680" }, { "incident": "microsoft-sql-server-cve-2020-0618", "incidentTitle": "Microsoft SQL Server Reporting Services Remote Code Execution", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-18", "title": "CISA added CVE-2020-0618 to the KEV catalog (federal deadline 2024-10-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sql-server-cve-2020-0618" }, { "incident": "progress-whatsup-gold-cve-2024-6670", "incidentTitle": "Progress WhatsUp Gold SQL Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-16", "title": "CISA added CVE-2024-6670 to the KEV catalog (federal deadline 2024-10-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670" }, { "incident": "linux-kernel-cve-2017-1000253", "incidentTitle": "Linux Kernel PIE Stack Buffer Corruption", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-09", "title": "CISA added CVE-2017-1000253 to the KEV catalog (federal deadline 2024-09-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/linux-kernel-cve-2017-1000253" }, { "incident": "sonicwall-sonicos-cve-2024-40766", "incidentTitle": "SonicWall SonicOS Improper Access Control", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-09", "title": "CISA added CVE-2024-40766 to the KEV catalog (federal deadline 2024-09-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-40766" }, { "incident": "veeam-backup-replication-cve-2024-40711", "incidentTitle": "Veeam Backup and Replication Deserialization", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-07", "title": "CVE-2024-40711 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-40711", "url": "https://pwn.watch/i/veeam-backup-replication-cve-2024-40711" }, { "incident": "progress-whatsup-gold-cve-2024-6670", "incidentTitle": "Progress WhatsUp Gold SQL Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-29", "title": "CVE-2024-6670 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-6670", "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670" }, { "incident": "sonicwall-sonicos-cve-2024-40766", "incidentTitle": "SonicWall SonicOS Improper Access Control", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-23", "title": "CVE-2024-40766 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-40766", "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-40766" }, { "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-19", "title": "CISA added CVE-2024-23897 to the KEV catalog (federal deadline 2024-09-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897" }, { "incident": "vmware-esxi-cve-2024-37085", "incidentTitle": "VMware ESXi Authentication Bypass", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2024-07-30", "title": "CISA added CVE-2024-37085 to the KEV catalog (federal deadline 2024-08-20)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/vmware-esxi-cve-2024-37085" }, { "incident": "microsoft-sharepoint-cve-2024-38094", "incidentTitle": "Microsoft SharePoint Deserialization", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CVE-2024-38094 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38094", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094" }, { "incident": "rejetto-http-file-server-cve-2024-23692", "incidentTitle": "Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CISA added CVE-2024-23692 to the KEV catalog (federal deadline 2024-07-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/rejetto-http-file-server-cve-2024-23692" }, { "incident": "vmware-esxi-cve-2024-37085", "incidentTitle": "VMware ESXi Authentication Bypass", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2024-06-25", "title": "CVE-2024-37085 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-37085", "url": "https://pwn.watch/i/vmware-esxi-cve-2024-37085" }, { "incident": "microsoft-windows-cve-2024-26169", "incidentTitle": "Microsoft Windows Error Reporting Service Improper Privilege Management", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-13", "title": "CISA added CVE-2024-26169 to the KEV catalog (federal deadline 2024-07-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-26169" }, { "incident": "php-cgi-argument-injection-cve-2024-4577", "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-12", "title": "CISA added CVE-2024-4577 to the KEV catalog (federal deadline 2024-07-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577" }, { "incident": "microsoft-windows-cve-2024-30088", "incidentTitle": "Microsoft Windows Kernel TOCTOU Race Condition", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-11", "title": "CVE-2024-30088 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30088", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-30088" }, { "incident": "php-cgi-argument-injection-cve-2024-4577", "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-09", "title": "CVE-2024-4577 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-4577", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577" }, { "incident": "php-cgi-argument-injection-cve-2024-4577", "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-06", "title": "DEVCORE discloses CVE-2024-4577; fixed PHP releases available", "body": null, "sourceUrl": "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577" }, { "incident": "rejetto-http-file-server-cve-2024-23692", "incidentTitle": "Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-05-31", "title": "CVE-2024-23692 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-23692", "url": "https://pwn.watch/i/rejetto-http-file-server-cve-2024-23692" }, { "incident": "check-point-quantum-gateway-info-disclosure-cve-2024-24919", "incidentTitle": "Check Point VPN gateway arbitrary file read (CVE-2024-24919) exploited", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-30", "title": "CISA added CVE-2024-24919 to the KEV catalog (federal deadline 2024-06-20)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/check-point-quantum-gateway-info-disclosure-cve-2024-24919" }, { "incident": "linux-kernel-nf-tables-use-after-free-cve-2024-1086", "incidentTitle": "Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-30", "title": "CISA added CVE-2024-1086 to the KEV catalog (federal deadline 2024-06-20)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086" }, { "incident": "check-point-quantum-gateway-info-disclosure-cve-2024-24919", "incidentTitle": "Check Point VPN gateway arbitrary file read (CVE-2024-24919) exploited", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-28", "title": "CVE-2024-24919 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-24919", "url": "https://pwn.watch/i/check-point-quantum-gateway-info-disclosure-cve-2024-24919" }, { "incident": "nextgen-healthcare-mirth-connect-cve-2023-43208", "incidentTitle": "NextGen Healthcare Mirth Connect Deserialization of Untrusted Data", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-05-20", "title": "CISA added CVE-2023-43208 to the KEV catalog (federal deadline 2024-06-10)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CVE-2024-30040 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30040", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CVE-2024-30051 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30051", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CISA added CVE-2024-30040 to the KEV catalog (federal deadline 2024-06-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CISA added CVE-2024-30051 to the KEV catalog (federal deadline 2024-06-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-05-01", "title": "CEO Andrew Witty testifies before the Senate Finance Committee", "body": null, "sourceUrl": "https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-04-22", "title": "UnitedHealth: stolen files could cover a substantial proportion of people in America", "body": null, "sourceUrl": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-12", "title": "CVE-2024-3400 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3400", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400" }, { "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-12", "title": "CISA added CVE-2024-3400 to the KEV catalog (federal deadline 2024-04-19)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400" }, { "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-12", "title": "Palo Alto publishes the advisory; Volexity and Unit 42 publish exploitation details", "body": null, "sourceUrl": "https://security.paloaltonetworks.com/CVE-2024-3400", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400" }, { "incident": "microsoft-sharepoint-server-cve-2023-24955", "incidentTitle": "Microsoft SharePoint Server Code Injection", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-03-26", "title": "CISA added CVE-2023-24955 to the KEV catalog (federal deadline 2024-04-16)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955" }, { "incident": "ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529", "incidentTitle": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-25", "title": "CISA added CVE-2021-44529 to the KEV catalog (federal deadline 2024-04-15)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529" }, { "incident": "fortinet-forticlient-ems-cve-2023-48788", "incidentTitle": "Fortinet FortiClient EMS SQL Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-25", "title": "CISA added CVE-2023-48788 to the KEV catalog (federal deadline 2024-04-15)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788" }, { "incident": "fortinet-forticlient-ems-cve-2023-48788", "incidentTitle": "Fortinet FortiClient EMS SQL Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-12", "title": "CVE-2023-48788 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-48788", "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788" }, { "incident": "microsoft-windows-cve-2024-26169", "incidentTitle": "Microsoft Windows Error Reporting Service Improper Privilege Management", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-03-12", "title": "CVE-2024-26169 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-26169", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-26169" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-07", "title": "CISA added CVE-2024-27198 to the KEV catalog (federal deadline 2024-03-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "CVE-2024-27198 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27198", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "CVE-2024-27199 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27199", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199", "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "JetBrains releases TeamCity 2023.11.4; Rapid7 publishes details of both auth bypasses", "body": null, "sourceUrl": "https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199" }, { "incident": "microsoft-windows-cve-2024-21338", "incidentTitle": "Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "CISA added CVE-2024-21338 to the KEV catalog (federal deadline 2024-03-25)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-21338" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-02-22", "title": "UnitedHealth files an SEC 8-K on the cybersecurity incident", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/731766/000073176624000085/unh-20240221.htm", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-22", "title": "CISA added CVE-2024-1709 to the KEV catalog (federal deadline 2024-02-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709" }, { "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-22", "title": "ConnectWise urges on-premise partners to update to 23.9.8 immediately", "body": null, "sourceUrl": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-02-21", "title": "Ransomware deployed; Change Healthcare systems disconnected", "body": null, "sourceUrl": "https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-21", "title": "CVE-2024-1709 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1709", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709" }, { "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-21", "title": "CVE-2024-1708 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1708", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709" }, { "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709", "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-19", "title": "Both vulnerabilities reported to ConnectWise; cloud instances remediated", "body": null, "sourceUrl": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8", "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709" }, { "incident": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259", "incidentTitle": "Cisco ASA and FTD Information Disclosure", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-15", "title": "CISA added CVE-2020-3259 to the KEV catalog (federal deadline 2024-03-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259" }, { "incident": "microsoft-windows-cve-2024-21338", "incidentTitle": "Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21338 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21338", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-21338" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21351 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21351", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21412 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21412", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CISA added CVE-2024-21351 to the KEV catalog (federal deadline 2024-03-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CISA added CVE-2024-21412 to the KEV catalog (federal deadline 2024-03-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-02-12", "title": "Attackers access a Change Healthcare Citrix portal with stolen credentials (no MFA), per CEO testimony", "body": null, "sourceUrl": "https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "fortinet-fortios-cve-2024-21762", "incidentTitle": "Fortinet FortiOS Out-of-Bound Write", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-09", "title": "CVE-2024-21762 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21762", "url": "https://pwn.watch/i/fortinet-fortios-cve-2024-21762" }, { "incident": "fortinet-fortios-cve-2024-21762", "incidentTitle": "Fortinet FortiOS Out-of-Bound Write", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-09", "title": "CISA added CVE-2024-21762 to the KEV catalog (federal deadline 2024-02-16)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/fortinet-fortios-cve-2024-21762" }, { "incident": "linux-kernel-nf-tables-use-after-free-cve-2024-1086", "incidentTitle": "Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CVE-2024-1086 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1086", "url": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CVE-2024-21893 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21893", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CISA added CVE-2024-21893 to the KEV catalog (federal deadline 2024-02-02)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CISA Supplemental Direction V1: federal agencies must disconnect all Ivanti Connect Secure and Policy Secure instances by 2024-02-02", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-24", "title": "CVE-2024-23897 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-23897", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897" }, { "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-24", "title": "Jenkins security advisory and fixed releases", "body": null, "sourceUrl": "https://www.jenkins.io/security/advisory/2024-01-24/", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897" }, { "incident": "atlassian-confluence-data-center-and-server-cve-2023-22527", "incidentTitle": "Atlassian Confluence Data Center and Server Template Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-24", "title": "CISA added CVE-2023-22527 to the KEV catalog (federal deadline 2024-02-14)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-19", "title": "CISA issues Emergency Directive 24-01 for Ivanti Connect Secure and Policy Secure", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082", "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-18", "title": "CISA added CVE-2023-35082 to the KEV catalog (federal deadline 2024-02-08)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082" }, { "incident": "atlassian-confluence-data-center-and-server-cve-2023-22527", "incidentTitle": "Atlassian Confluence Data Center and Server Template Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-16", "title": "CVE-2023-22527 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-22527", "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-12", "title": "CVE-2023-46805 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-46805", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-12", "title": "CVE-2024-21887 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21887", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "CISA added CVE-2023-46805 to the KEV catalog (federal deadline 2024-01-22)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "CISA added CVE-2024-21887 to the KEV catalog (federal deadline 2024-01-22)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "Volexity discloses active exploitation of two Ivanti Connect Secure zero-days", "body": null, "sourceUrl": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "microsoft-sharepoint-server-cve-2023-29357", "incidentTitle": "Microsoft SharePoint Server Privilege Escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "CISA added CVE-2023-29357 to the KEV catalog (federal deadline 2024-01-31)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357" }, { "incident": "adobe-coldfusion-cve-2023-29300-38203", "incidentTitle": "Adobe ColdFusion: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-08", "title": "CISA added CVE-2023-29300 to the KEV catalog (federal deadline 2024-01-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203" }, { "incident": "adobe-coldfusion-cve-2023-29300-38203", "incidentTitle": "Adobe ColdFusion: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-08", "title": "CISA added CVE-2023-38203 to the KEV catalog (federal deadline 2024-01-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-12-18", "title": "Xfinity discloses that Citrix Bleed exploitation on Oct 16–19 exposed data on 35.9M customers", "body": null, "sourceUrl": "https://www.theverge.com/2023/12/18/24007082/xfinity-data-breach-hack-notice-citrix", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "qlik-sense-cve-2023-41265-41266", "incidentTitle": "Qlik Sense: 2 exploited vulnerabilities (CVE-2023-41265, CVE-2023-41266)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-12-07", "title": "CISA added CVE-2023-41265 to the KEV catalog (due 2023-12-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/qlik-sense-cve-2023-41265-41266" }, { "incident": "qlik-sense-cve-2023-41265-41266", "incidentTitle": "Qlik Sense: 2 exploited vulnerabilities (CVE-2023-41265, CVE-2023-41266)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-12-07", "title": "CISA added CVE-2023-41266 to the KEV catalog (due 2023-12-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/qlik-sense-cve-2023-41265-41266" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-21", "title": "CISA, FBI, MS-ISAC and ACSC warn that LockBit 3.0 affiliates are exploiting Citrix Bleed (AA23-325A)", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "sysaid-server-cve-2023-47246", "incidentTitle": "SysAid Server: Path Traversal (CVE-2023-47246)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-13", "title": "CISA added CVE-2023-47246 to the KEV catalog (due 2023-12-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sysaid-server-cve-2023-47246" }, { "incident": "atlassian-confluence-improper-authorization-cve-2023-22518", "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-07", "title": "CISA adds CVE-2023-22518 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518" }, { "incident": "atlassian-confluence-improper-authorization-cve-2023-22518", "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-06", "title": "Atlassian raises the CVSS score to 10 after active exploitation and Cerber ransomware deployments", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518" }, { "incident": "apache-activemq-openwire-rce-cve-2023-46604", "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-02", "title": "CISA adds CVE-2023-46604 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604" }, { "incident": "apache-activemq-openwire-rce-cve-2023-46604", "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-01", "title": "Rapid7 reports exploitation in two customer environments, attempting to deploy HelloKitty ransomware", "body": null, "sourceUrl": "https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/", "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604" }, { "incident": "atlassian-confluence-improper-authorization-cve-2023-22518", "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-31", "title": "Atlassian discloses CVE-2023-22518 and ships fixes", "body": null, "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html", "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518" }, { "incident": "f5-big-ip-configuration-utility-cve-2023-46747-46748", "incidentTitle": "F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-31", "title": "CISA added CVE-2023-46747 to the KEV catalog (due 2023-11-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748" }, { "incident": "f5-big-ip-configuration-utility-cve-2023-46747-46748", "incidentTitle": "F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-31", "title": "CISA added CVE-2023-46748 to the KEV catalog (due 2023-11-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748" }, { "incident": "apache-activemq-openwire-rce-cve-2023-46604", "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-27", "title": "Apache publishes the CVE-2023-46604 announcement; fixed releases already out", "body": null, "sourceUrl": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt", "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-23", "title": "Citrix issues additional mitigation guidance", "body": null, "sourceUrl": "https://assets.xfinity.com/assets/dotcom/learn/Notice%20To%20Customers%20of%20Data%20Security%20Incident.pdf", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-18", "title": "CISA adds CVE-2023-4966 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-17", "title": "Mandiant reports zero-day exploitation since late August 2023 and session hijacking that survives patching", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/session-hijacking-citrix-cve-2023-4966", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-10", "title": "Citrix publishes bulletin CTX579459 and fixed builds", "body": null, "sourceUrl": "https://support.citrix.com/external/article/CTX579459/netscaler-adc-and-netscaler-gateway-secu.html", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "progress-ws-ftp-server-cve-2023-40044", "incidentTitle": "Progress WS_FTP Server: Deserialization of Untrusted Data (CVE-2023-40044)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-10-05", "title": "CISA added CVE-2023-40044 to the KEV catalog (due 2023-10-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-10-05", "title": "MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-14", "title": "Caesars 8-K filing; reports say it paid about half of a $30M demand", "body": null, "sourceUrl": "https://www.cnbc.com/2023/09/14/caesars-paid-millions-in-ransom-to-cybercrime-group-prior-to-mgm-hack.html", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "cisco-adaptive-security-appliance-and-threat-cve-2023-20269", "incidentTitle": "Cisco Adaptive Security Appliance and Firepower Threat Defense: Unauthorized Access (CVE-2023-20269)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-09-13", "title": "CISA added CVE-2023-20269 to the KEV catalog (due 2023-10-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-and-threat-cve-2023-20269" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-12", "title": "MGM statement on the cybersecurity issue", "body": null, "sourceUrl": "https://investors.mgmresorts.com/2023-09-12-MGM-RESORTS-INTERNATIONAL-STATEMENT-ON-CYBERSECURITY-ISSUE", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-11", "title": "MGM Resorts discloses a cybersecurity issue and shuts down systems; reservations, slot machines and ATMs are disrupted", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/mgm-resorts-ransomware-attack-led-to-100-million-loss-data-theft/", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-07", "title": "Caesars determines the attacker copied its loyalty program database, including driver's license and/or SSNs for many members", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "ivanti-sentry-cve-2023-38035", "incidentTitle": "Ivanti Sentry: Authentication Bypass (CVE-2023-38035)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-08-22", "title": "CISA added CVE-2023-38035 to the KEV catalog (due 2023-09-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-sentry-cve-2023-38035" }, { "incident": "veeam-backup-replication-cve-2023-27532", "incidentTitle": "Veeam Backup & Replication: Cloud Connect Missing Authentication for Critical Function (CVE-2023-27532)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-22", "title": "CISA added CVE-2023-27532 to the KEV catalog (due 2023-09-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/veeam-backup-replication-cve-2023-27532" }, { "incident": "microsoft-windows-cve-2023-36884", "incidentTitle": "Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-17", "title": "CISA added CVE-2023-36884 to the KEV catalog (due 2023-08-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36884" }, { "incident": "netwrix-auditor-cve-2022-31199", "incidentTitle": "Netwrix Auditor: Insecure Object Deserialization (CVE-2022-31199)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-11", "title": "CISA added CVE-2022-31199 to the KEV catalog (due 2023-08-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/netwrix-auditor-cve-2022-31199" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-16", "title": "Third round of fixes for CVE-2023-35708 after a public proof of concept", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35708", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-09", "title": "Progress fixes more SQL injection bugs found during code review (CVE-2023-35036)", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35036", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-07", "title": "CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505)", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-02", "title": "CISA adds CVE-2023-34362 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-31", "title": "Progress discloses the critical MOVEit Transfer vulnerability and ships patches", "body": null, "sourceUrl": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-27", "title": "Earliest exploitation of the MOVEit Transfer zero-day seen by Mandiant", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "papercut-mf-ng-auth-bypass-cve-2023-27350", "incidentTitle": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-11", "title": "CISA and FBI advisory AA23-131A: Bl00dy Ransomware Gang targeting education via PaperCut", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a", "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350" }, { "incident": "papercut-mf-ng-auth-bypass-cve-2023-27350", "incidentTitle": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-04-21", "title": "PaperCut warns that unpatched servers are being exploited in the wild; CISA adds CVE-2023-27350 to KEV", "body": null, "sourceUrl": "https://www.papercut.com/kb/Main/PO-1216-and-PO-1219", "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350" }, { "incident": "microsoft-windows-cve-2023-28252", "incidentTitle": "Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-04-11", "title": "CISA added CVE-2023-28252 to the KEV catalog (due 2023-05-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-28252" }, { "incident": "microsoft-windows-cve-2023-24880", "incidentTitle": "Microsoft Windows: SmartScreen Security Feature Bypass (CVE-2023-24880)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-03-14", "title": "CISA added CVE-2023-24880 to the KEV catalog (due 2023-04-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-24880" }, { "incident": "zk-framework-auuploader-cve-2022-36537", "incidentTitle": "ZK Framework AuUploader: Unspecified (CVE-2022-36537)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-27", "title": "CISA added CVE-2022-36537 to the KEV catalog (due 2023-03-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537" }, { "incident": "ibm-aspera-faspex-cve-2022-47986", "incidentTitle": "IBM Aspera Faspex: Code Execution (CVE-2022-47986)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-02-21", "title": "CISA added CVE-2022-47986 to the KEV catalog (due 2023-03-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ibm-aspera-faspex-cve-2022-47986" }, { "incident": "mitel-mivoice-connect-cve-2022-40765-41223", "incidentTitle": "Mitel MiVoice Connect: 2 exploited vulnerabilities (CVE-2022-40765, CVE-2022-41223)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-02-21", "title": "CISA added CVE-2022-40765 to the KEV catalog (due 2023-03-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/mitel-mivoice-connect-cve-2022-40765-41223" }, { "incident": "mitel-mivoice-connect-cve-2022-40765-41223", "incidentTitle": "Mitel MiVoice Connect: 2 exploited vulnerabilities (CVE-2022-40765, CVE-2022-41223)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-02-21", "title": "CISA added CVE-2022-41223 to the KEV catalog (due 2023-03-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/mitel-mivoice-connect-cve-2022-40765-41223" }, { "incident": "microsoft-windows-cve-2023-21823-23376", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-14", "title": "CISA added CVE-2023-21823 to the KEV catalog (due 2023-03-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376" }, { "incident": "microsoft-windows-cve-2023-21823-23376", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-14", "title": "CISA added CVE-2023-23376 to the KEV catalog (due 2023-03-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376" }, { "incident": "terramaster-os-cve-2022-24990", "incidentTitle": "TerraMaster OS: Remote Command Execution (CVE-2022-24990)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-10", "title": "CISA added CVE-2022-24990 to the KEV catalog (due 2023-03-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/terramaster-os-cve-2022-24990" }, { "incident": "goanywhere-mft-cl0p-cve-2023-0669", "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-10", "title": "CISA adds CVE-2023-0669 to KEV; Cl0p claims it breached over 130 organisations", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-it-breached-130-orgs-using-goanywhere-zero-day/", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669" }, { "incident": "goanywhere-mft-cl0p-cve-2023-0669", "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-07", "title": "Emergency patch: GoAnywhere MFT 7.1.2", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669" }, { "incident": "oracle-e-business-suite-cve-2022-21587", "incidentTitle": "Oracle E-Business Suite: Unspecified (CVE-2022-21587)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-02-02", "title": "CISA added CVE-2022-21587 to the KEV catalog (due 2023-02-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2022-21587" }, { "incident": "goanywhere-mft-cl0p-cve-2023-0669", "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-01", "title": "Fortra privately warns customers of an actively exploited zero-day in the GoAnywhere admin console", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669" }, { "incident": "zoho-manageengine-cve-2022-47966", "incidentTitle": "Zoho ManageEngine: Remote Code Execution (CVE-2022-47966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-01-23", "title": "CISA added CVE-2022-47966 to the KEV catalog (due 2023-02-13).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zoho-manageengine-cve-2022-47966" }, { "incident": "microsoft-exchange-server-cve-2022-41080", "incidentTitle": "Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-01-10", "title": "CISA added CVE-2022-41080 to the KEV catalog (due 2023-01-31).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080" } ] }